How to create a Kibana (Elasticsearch) Scripted Field programatically?

Question

Kibana's UI allows the user to create a scripted field which is stored as part of the index (screenshot below). How can that be done programatically? In particular, using either the NEST client or the Elasticsearch low level client.

Kibana UI for the Indice with the Scripted Fields tab highlighted

Note that I am not asking how to create add an expression/script field as part of a query, I'm specifically looking for how to add it as part of the Index when the mapping is created so that queries can reference it without having to explicitly include it.

Answer 1

Kibana dashboards are stored in the .kibana index. To export dashboards, you can query the Kibana index as you would any other index. For example, curl -XGET http://localhost:9200/.kibana/_search?type=dashboard&pretty would show the JSON for your dashboards. You could export the template, add the scripted field to the JSON, and then POST it again. Since Kibana uses a standard Elasticsearch index, the normal Elasticsearch API would apply to modifying Kibana dashboards. This may provide a little more clarification.

Answer 2

At the time of writing, current version 5.2 does not have an official way to do this.

This is how I do it:

1. Get index fields: GET /.kibana/index-pattern/YOUR_INDEX

2. Add your scripted field to _source.fields (as string, notice scaped quotation marks)

   "fields":"[...,{\"name\":\"test\",\"type\":\"number\",\"count\":0,\"scripted\":true,\"script\":\"doc['area_id'].value\",\"lang\":\"painless\",\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true}]"
   

3. Post back _source json to /.kibana/index-pattern/YOUR_INDEX

   {
       "title":"YOUR_INDEX",
       "timeFieldName":"time",
       "fields":"[...,{\"name\":\"test\",...}]"
   }