Runtime fields in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What are runtime fields in Elasticsearch?

Runtime fields are fields that are computed on the fly during query time, without being stored on disk. They allow you to define new fields based on existing data without reindexing.

beginner

How do runtime fields differ from stored fields in Elasticsearch?

Stored fields are saved on disk during indexing and retrieved during search. Runtime fields are calculated dynamically at query time and are not stored, which means no reindexing is needed to add or change them.

beginner

Which scripting language is commonly used to define runtime fields in Elasticsearch?

Painless is the default and recommended scripting language used to define runtime fields in Elasticsearch because it is secure and optimized for performance.

intermediate

Example: What does this runtime field script do?<br>

emit(doc['price'].value * 1.2)

This script creates a runtime field that calculates a new value by multiplying the existing 'price' field by 1.2, effectively adding a 20% increase to the price at query time.

intermediate

Can runtime fields be used for sorting and aggregations in Elasticsearch?

Yes, runtime fields can be used for sorting and aggregations, but because they are computed at query time, they may be slower than using stored fields.

What is the main advantage of using runtime fields in Elasticsearch?

A No need to reindex data to add or change fields

B They are stored permanently on disk

C They improve indexing speed

D They replace all stored fields

Runtime fields are computed at query time, so you can add or modify them without reindexing your data.

Which language is used to write scripts for runtime fields?

A JavaScript

B Painless

C Python

D SQL

Painless is the default scripting language for runtime fields in Elasticsearch.

Runtime fields are computed when?

A During indexing

B Only during cluster restart

C At query time

D When data is stored

Runtime fields are calculated dynamically at query time, not during indexing.

Which of these is a limitation of runtime fields?

A May be slower than stored fields for queries

B Cannot be used in aggregations

C Require reindexing to change

D Cannot access other fields

Because runtime fields are computed on the fly, queries using them can be slower than those using stored fields.

What does this runtime field script do?

emit(doc['age'].value + 5)

A Subtracts 5 from age

B Multiplies age by 5

C Divides age by 5

D Adds 5 to age

The script adds 5 to the value of the 'age' field and emits the result.

Explain what runtime fields are and why they are useful in Elasticsearch.

Think about how you can add new data views without changing stored data.

Describe how you would create a runtime field that increases a numeric field by 10%.

Consider a simple math operation inside the script.