@@ -48,6 +48,7 @@ support version >= 2.x and <= 8.x.
4848| tls_truststore_password | string | no | - |
4949| pit_keep_alive | long | no | 60000 (1 minute) |
5050| pit_batch_size | int | no | 100 |
51+ | runtime_fields | array | no | - |
5152| common-options | | no | - |
5253
5354
@@ -211,6 +212,50 @@ The amount of time (in milliseconds) for which the PIT should be keep alive
211212### pit_batch_size [ int]
212213Maximum number of hits to be returned with each PIT search request
213214
215+ ### runtime_fields [ array]
216+
217+ Runtime fields to be computed at query time (Elasticsearch 7.11+). Each runtime field should contain:
218+ - ** name** : The name of the runtime field
219+ - ** type** : The data type (boolean, date, double, geo_point, ip, keyword, long)
220+ - ** script** : Painless script to compute the field value
221+ - ** script_lang** (optional): Script language (default: painless)
222+ - ** script_params** (optional): Script parameters
223+
224+ Example:
225+ ``` hocon
226+ runtime_fields = [
227+ {
228+ name = "day_of_week"
229+ type = "keyword"
230+ script = "emit(doc['timestamp'].value.dayOfWeekEnum.toString())"
231+ },
232+ {
233+ name = "total_price"
234+ type = "double"
235+ script = "emit(doc['quantity'].value * doc['price'].value)"
236+ }
237+ ]
238+ ```
239+
240+ ** Runtime Fields Use Cases:**
241+
242+ 1 . ** Date Extraction** : Extract day of week, month, year from timestamps
243+ 2 . ** Calculations** : Compute derived values like total price, tax amount
244+ 3 . ** String Operations** : Concatenate fields, extract substrings
245+ 4 . ** Conditional Logic** : Categorize data based on conditions
246+ 5 . ** Data Transformation** : Convert units, format values on-the-fly
247+
248+ ** Performance Considerations:**
249+ - Runtime fields are computed at query time, which may impact performance for large datasets
250+ - Best suited for ad-hoc analysis, prototyping, and infrequent queries
251+ - Keep scripts simple to minimize performance impact
252+ - Consider indexing frequently used computed fields
253+
254+ ** Limitations:**
255+ - Requires Elasticsearch 7.11 or higher
256+ - Only Painless scripts are supported
257+ - May be slower than indexed fields for large-scale queries
258+
214259### common options
215260
216261Source plugin common parameters, please refer to [ Source Common Options] ( ../common-options/source-common-options.md ) for details
@@ -386,6 +431,94 @@ source {
386431}
387432```
388433
434+ Demo 8: Runtime Fields (Elasticsearch 7.11+)
435+
436+ > This example demonstrates how to use runtime fields to compute values at query time without reindexing data.
437+
438+ ``` hocon
439+ source {
440+ Elasticsearch {
441+ hosts = ["https://elasticsearch:9200"]
442+ username = "elastic"
443+ password = "elasticsearch"
444+ tls_verify_certificate = false
445+ tls_verify_hostname = false
446+
447+ index = "sales_data"
448+
449+ # Define runtime fields for dynamic computation
450+ runtime_fields = [
451+ {
452+ # Calculate total amount
453+ name = "total_amount"
454+ type = "double"
455+ script = "emit(doc['quantity'].value * doc['price'].value)"
456+ },
457+ {
458+ # Extract day of week from timestamp
459+ name = "day_of_week"
460+ type = "keyword"
461+ script = "emit(doc['order_date'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))"
462+ },
463+ {
464+ # Categorize orders
465+ name = "order_category"
466+ type = "keyword"
467+ script = """
468+ double amount = doc['quantity'].value * doc['price'].value;
469+ if (amount > 1000) {
470+ emit('high_value');
471+ } else if (amount > 100) {
472+ emit('medium_value');
473+ } else {
474+ emit('low_value');
475+ }
476+ """
477+ },
478+ {
479+ # Calculate with parameters
480+ name = "price_with_tax"
481+ type = "double"
482+ script = "emit(doc['price'].value * (1 + params.tax_rate))"
483+ script_params = {
484+ tax_rate = 0.13
485+ }
486+ }
487+ ]
488+
489+ # Include runtime fields in the output
490+ source = [
491+ "product_id",
492+ "quantity",
493+ "price",
494+ "order_date",
495+ "total_amount",
496+ "day_of_week",
497+ "order_category",
498+ "price_with_tax"
499+ ]
500+
501+ schema = {
502+ fields {
503+ product_id = string
504+ quantity = int
505+ price = double
506+ order_date = timestamp
507+ total_amount = double
508+ day_of_week = string
509+ order_category = string
510+ price_with_tax = double
511+ }
512+ }
513+ }
514+ }
515+
516+ sink {
517+ Console {
518+ }
519+ }
520+ ```
521+
389522## Changelog
390523
391524<ChangeLog />
0 commit comments