Elasticsearch runtime fields
Bring data into Elasticsearch in a fast and flexible way — and easily adapt to change — with runtime fields, Elastic’s implementation of schema on read. Only Elastic delivers both the blazing fast speed of schema on write and the extreme utility of schema on read.
When you ingest new data, you might not know how it’ll be searched yet. And that’s okay. With runtime fields, you can skip defining fields in advance to save time and create fields on the fly. Plus, you can always apply any of your runtime fields to the next index as indexed fields for faster searches.
Just when your cluster has been quietly humming in the background, a log message changes and breaks your index mapping. With runtime fields, you don’t have to start over. You can keep the fields that still apply while dynamically creating new fields for the changes in your data.
With runtime fields, you can also define new ways of analyzing data that’s already been indexed. Create a new runtime field using any combination of existing fields to be used in a query or visualization. These changes can apply only to you, allowing you to explore data without impacting others’ work.
We’ve all made mistakes. Before runtime fields, you’d have to correct the index mapping and _reindex the data, prolonging the outage. Now you can shadow the incorrect field with a runtime field to immediately fix the error without a _reindex. This lets you be more agile and slashes QA time, which can reduce costs.
#In this index template, we've defined two fields,
#timestamp and response_code, which will be created
#when we ingest the data. We've also defined a
#dynamic runtime field mapping. Any other fields
#will be runtime fields.
PUT _index_template/my_dynamic_index
{
"index_patterns": [
"my_dynamic_index-*"
],
"template": {
"mappings":{
"dynamic": "runtime",
"properties": {
"timestamp": {
"type": "date",
"format": "yyyy-MM-dd"
},
"response_code": {
"type": "integer"
}
}
}
}
}
Take runtime fields for a spin with a free 14-day trial of Elastic Cloud. And if you have questions, visit the runtime fields documentation or the Elasticsearch searchable snapshot forum.