Schema-on-Read: A Practical Introduction to Runtime Fields in Elasticsearch and Kibana - Enrique Kortright - Principal Education Architect @ Elastic

Livestream: https://www.youtube.com/watch?v=ZQ9Bh0Lg0O8

Talk Abstract

Elasticsearch is known for its speed in retrieving data from an index. This is because the data is ready to use in fast data structures built for each indexed field based on their types. However, indexed fields take up significant space, have data types that cannot be modified after data is written to them, and can have incomplete or incorrect values. There are also fields you wish you had, including fields that can be derived from the values of other fields in the same or even other indices. If you are willing to sacrifice some of the speed of indexed fields, runtime fields solve these and other problems by giving you the ability to define or redefine, the index schema at runtime -- this is known as schema-on-read. Join Enrique as he introduces us to runtime fields, the Painless scripting language used to define them, and as he demonstrates their application in solving a variety of practical problems.