diff --git a/docs/management/images/stackManagement-indexPatterns-pinRuntimeField-7.15.png b/docs/management/images/stackManagement-indexPatterns-pinRuntimeField-7.15.png new file mode 100644 index 000000000000..49d0d4caec00 Binary files /dev/null and b/docs/management/images/stackManagement-indexPatterns-pinRuntimeField-7.15.png differ diff --git a/docs/management/manage-index-patterns.asciidoc b/docs/management/manage-index-patterns.asciidoc index ac07aa833c3b..08527ffa75d4 100644 --- a/docs/management/manage-index-patterns.asciidoc +++ b/docs/management/manage-index-patterns.asciidoc @@ -7,60 +7,60 @@ To customize the data fields in your index pattern, you can add runtime fields t [[runtime-fields]] === Explore your data with runtime fields -Runtime fields are fields that you add to documents after you've ingested, and are evaluated at query time. With runtime fields, you allow for a smaller index and faster ingest time so that you can use less resources and reduce your operating costs. You can use runtime fields anywhere index patterns are used. +Runtime fields are fields that you add to documents after you've ingested your data, and are evaluated at query time. With runtime fields, you allow for a smaller index and faster ingest time so that you can use less resources and reduce your operating costs. You can use runtime fields anywhere index patterns are used, for example, you can explore runtime fields in *Discover* and create visualizations with runtime fields for your dashboard. -When you use runtime fields, you can: +With runtime fields, you can: -* Define fields for a specific use without modifying the underlying schema. +* Define fields for a specific use case without modifying the underlying schema. * Override the returned values from index fields. -* Start working on your data without first understanding the structure. +* Start working on your data without understanding the structure. * Add fields to existing documents without reindexing your data. -* Explore runtime field data in *Discover*. - -* Create visualizations with runtime field data using *Lens*, *Maps*, and *TSVB*. - WARNING: Runtime fields can impact {kib} performance. When you run a query, {es} uses the fields you index first to shorten the response time. Index the fields that you commonly search for and filter on, such as `timestamp`, then use runtime fields to limit the number of fields {es} uses to calculate values. -For more information, refer to {ref}/runtime.html[Runtime fields]. +For detailed information on how to use runtime fields with {es}, refer to {ref}/runtime.html[Runtime fields]. [float] [[create-runtime-fields]] -==== Create runtime fields +==== Add runtime fields -Create runtime fields in your index patterns, or create runtime fields in *Discover* and *Lens*. +To add runtime fields to your index patterns, open the index pattern you want to change, then define the field values by emitting a single value using the {ref}/modules-scripting-painless.html[Painless scripting language]. You can also add runtime fields in <> and <>. . Open the main menu, then click *Stack Management > Index Patterns*. . Select the index pattern you want to add the runtime field to, then click *Add field*. -. Enter a *Name* for the runtime field, then select the field *Type*. +. Enter the field *Name*, then select the *Type*. -. Select *Set value*, then define the field value by emitting a single value using the {ref}/modules-scripting-painless.html[Painless scripting language]. -+ -The script must match the field *Type*, or the script fails. +. Select *Set custom label*, then enter the label you want to display where the index pattern is used, such as *Discover*. + +. Select *Set value*, then define the script. The script must match the *Type*, or the index pattern fails anywhere it is used. + +. To help you define the script, use the *Preview*: + +* To view the other available fields, use the *Document ID* arrows. + +* To filter the fields list, enter the keyword in *Filter fields*. + +* To pin frequently used fields to the top of the list, hover over the field, then click image:images/stackManagement-indexPatterns-pinRuntimeField-7.15.png[Icon to pin field to the top of the list]. . Click *Create field*. -+ -For information on how to create runtime fields in *Discover*, refer to <>. -+ -For information on how to create runtime fields in *Lens*, refer to <>. [float] [[runtime-field-examples]] ==== Runtime field examples -Try the runtime field examples on your own using the *Sample web logs* data index pattern. +Try the runtime field examples on your own using the <> data index pattern. [float] [[simple-hello-world-example]] ==== Return a keyword value -To return `Hello World!` value: +Return `Hello World!`: [source,text] ---- @@ -101,7 +101,7 @@ emit(""); [[replace-nulls-with-blanks]] ===== Replace nulls with blanks -Replace null values with none values: +Replace `null` values with `None`: [source,text] ---- @@ -115,7 +115,7 @@ else { } ---- -Specify operating system condition: +Specify the operating system condition: [source,text] ----