Provide an easy way to apply a runtime field to an index mapping or ingest processor #102467
Labels
enhancement
New value added to drive a business result
Feature:Data Views
Data Views code and UI - index patterns before 8.0
impact:low
Addressing this issue will have a low level of impact on the quality/strength of our product.
loe:small
Small Level of Effort
Team:DataDiscovery
Discover, search (e.g. data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL.
Describe the feature:
A feature within the Kibana Index management interface that allows an administrative user to easily convert a runtime field to a 'permanent' field within the Elasticsearch index mappings. It could be a button to apply the changes to the index directly, or even a pop-up that displays the command to run in the dev console to update the mapping for that field and remove the runtime field. If the runtime field contains a painless script it could be verified in the context of an ingest processor.
Describe a specific use case for the feature:
Scenario 1: Within a large organisation it is common to have analysts that work with the data every day and those analysts will create runtime fields in kibana for use in their queries and visualizations. Over time an index pattern may contain hundreds of runtime fields which could negatively impact cluster performance. An administrative user could use this feature to review the runtime fields on an index and quickly apply them to the mappings and ingest processors to reduce load on the cluster
Scenario 2: An analyst has an unmapped field in an index so they create a runtime field for use in their queries. They want to use this field in a watcher but at this time watchers can not reference runtime fields so they must first have an admin manually update the index field mappings.
The text was updated successfully, but these errors were encountered: