adding a script-based field to an elasticSearch index mapping

Question

I am following the following docs: https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-indexed.html

I have a field which I would like to not be scripted on runtime but rather on index-time, and according to above I can do that simply by putting the field and its script inside the mapping object as normal.

Here is a simplified version of the index I'm trying to create

{
  "settings": {
    "analysis": {
      "analyzer": {
        "case_insensitive_analyzer": {
          "type": "custom",
          "filter": ["lowercase"],
          "tokenizer": "keyword"
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "id": {
        "type": "text"
      },
      "events": {
        "properties": {
          "fields": {
            "type": "text"
          },
          "id": {
            "type": "text"
          },
          "event": {
            "type": "text"
          },
          "time": {
            "type": "date"
          },
          "user": {
            "type": "text"
          },
          "state": {
            "type": "integer"
          }
        }
      },
      "eventLast": {
        "type": "date",
        "on_script_error": "fail",
        "script": {
          "source": "def events = doc['events']; emit(events[events.length-1].time.value"
        }
      }
    }
  }
}

I'm getting this 400 error back:

{
    "error": {
        "root_cause": [
            {
                "type": "mapper_parsing_exception",
                "reason": "unknown parameter [script] on mapper [eventLast] of type [date]"
            }
        ],
        "type": "mapper_parsing_exception",
        "reason": "Failed to parse mapping [_doc]: unknown parameter [script] on mapper [eventLast] of type [date]",
        "caused_by": {
            "type": "mapper_parsing_exception",
            "reason": "unknown parameter [script] on mapper [eventLast] of type [date]"
        }
    },
    "status": 400
}

Essentially I'm trying to create a scripted indexed field that is calculated off the last event time in the events array of the document.

Thanks

Answer 1

Tldr;

As the error states, you can not define your script in here. There is a specific way to create runtime fields in elasticsearch.

You need to put the definition at the root of the json in the runtime object.

Solution

{
  "settings": {
    "analysis": {
      "analyzer": {
        "case_insensitive_analyzer": {
          "type": "custom",
          "filter": ["lowercase"],
          "tokenizer": "keyword"
        }
      }
    }
  },
  "runtime": {
    "eventLast": {
      "type": "date",
      "on_script_error": "fail",
      "script": {
        "source": "def events = doc['events']; emit(events[events.length-1].time.value"
      }
    }
  },
  "mappings": {
    "properties": {
      "id": {
        "type": "text"
      },
      "events": {
        "properties": {
          "fields": {
            "type": "text"
          },
          "id": {
            "type": "text"
          },
          "event": {
            "type": "text"
          },
          "time": {
            "type": "date"
          },
          "user": {
            "type": "text"
          },
          "state": {
            "type": "integer"
          }
        }
      }
    }
  }
}