Runtime Field in Elasticsearch
Let's explore another feature of Elasticsearch, where you can build new fields based on currently available fields.
For Example, if you have fields named first_name
and second_name
but in the response, you need a field named full_name
. You can simply use script_fields.
Define an index mapping with a field that will be used for the runtime field calculation. Here's a sample mapping for an index named my_index
:
PUT my_index
{
"mappings": {
"properties": {
"field1": {
"type": "keyword"
},
"field2": {
"type": "keyword"
}
}
}
}
Index some documents with values in "first_name" and "second_name":
POST my_index/_doc/1
{
"first_name": "John",
"second_name": "Doe"
}
POST my_index/_doc/2
{
"first_name": "Jane",
"second_name": "Smith"
}
Perform a search query with a script_fields
parameter to create the "full_name" runtime field based on the existing fields:
GET my_index/_search
{
"query": {
"match_all": {}
},
"script_fields": {
"full_name": {
"script": {
"source": "params['_source']['first_name'] + ' ' + params['_source']['second_name']",
"lang": "painless"
}
}
}
}
The response will include the original documents along with the newly created "full_name" field:
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 2,
"relation": "eq"
},
"max_score": 1.0,
"hits": [
{
"_index": "my_index",
"_type": "_doc",
"_id": "1",
"_score": 1.0,
"_source": {
"first_name": "John",
"second_name": "Doe"
},
"fields": {
"full_name": [
"John Doe"
]
}
},
{
"_index": "my_index",
"_type": "_doc",
"_id": "2",
"_score": 1.0,
"_source": {
"first_name": "Jane",
"second_name": "Smith"
},
"fields": {
"full_name": [
"Jane Smith"
]
}
}
]
}
}
Thats It! It's simple!
If you have any other ideas or suggestions, please do share them in the comments or connect with me on Twitter.