Indexed runtime field is executed at query time, instead of being read from disk.

[philippkahr]

fyi @herrBez

Elasticsearch Version

8.17.0 (probably all)

Installed Plugins

No response

Java Version

bundled

OS Version

ESS

Problem Description

Runtime field inside the mapping writes the value to disk. It is expected to read it from disk as well. However, in this case it is executed at query time, thus re-executing the script.

Steps to Reproduce

Run this:

PUT eventingested
{
  "mappings": {
    "properties": {
      "event": {
        "properties": {
          "ingested": {
        "type": "date",
        "on_script_error": "fail", 
        "script": {
          "source": """
            
        emit(new Date().getTime())
        """}
      }
        }
      }
    }
  }
}

POST eventingested/_doc?refresh=true
{
  "message": "ok"
}

GET eventingested/_search
{
  "fields": [
    "event.ingested"
  ]
}

And you get as event.ingested the query time and not the index time.

Logs (if relevant)

No response

[elasticsearchmachine]

Pinging @elastic/es-search-foundations (Team:Search Foundations)