Parameters for Scripted Fields

[dcode]

Expose parameters for scripted fields as documented in the Search API reference.

The UI would allow adding a dynamic form field with a "Add parameter" button. This would create two text input controls, specifying the parameter name and value. Maybe there's a performance reason to set a limit on the maximum number of fields.

For the backend field definition in the fields attribute of the index pattern, I recommend simply adding a params object like so:

    "bro_fields": {
        "aggregatable": true, 
        "count": 0, 
        "lang": "painless", 
        "name": "network.pcap", 
        "readFromDocValues": false, 
        "params": { 
            "baseUrl": "https://127.0.0.1/docket/api/"
         },
        "script": "String baseUrl = params.api_url; \nif (doc['event.type'].value == 'network') {  \n    String host1 = doc['source.ip'].value; \n    String host2 = doc['destination.ip'].value; \n    String port1 = doc['source.port'].toString(); \n    String port2 = doc['destination.port'].toString(); \n  return baseUrl + \n        'host/' + host1 + '/port/' + port1 + \n        '/host/' + host2 + '/port/' + port2  \n } \nreturn '';", 
        "scripted": true, 
        "searchable": true, 
        "type": "string"
    }

My particular use case is that I'm a core developer of RockNSM and I want to create a calculated field that depends on both the schema (which is static) and the deployment (which changes every install). Namely, I have to be able to build a URL field given the record data and point to an IP/hostname that depends on the deployment.

Short of #16252 with the granularity of individual field manipulation parameters would make my life a lot easier. The workd around is:

1. extract the index pattern
2. extract both the fields and fieldFormatMap data, decode them to JSON
3. update the JSON for the individual field
4. push back to kibana, overwriting the entire index
5. ...
6. Profit!

P.S. ~ Not likely, but I'll give you a bonus 🍄 (<-- GitHub doesn't have a 1UP) if you can make this by 6.3 or a patch release soon thereafter.

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServicesSv)

[mattkime]

Scripted fields have been deprecated and are being replaced with runtime fields. We have APIs that would help you do something approximating this - https://www.elastic.co/guide/en/kibana/current/index-patterns-api.html