Invalid Painless script: error during runtime field creation

[dgmyr]

Hello, i'm trying to add a new runtime field to my dataview in Kibana (Elastic v 8.4.3, SO v 2.3.190) but i found an error "Invalid Painless script." . This error is present even if I use a simple script from the elastic guide (https://www.elastic.co/guide/en/kibana/8.4/managing-data-views.html#runtime-fields) :

And I noticed that this error is present when i'm trying to modify my runtime fields that have been created previously but they continue to work properly in the discovery and dashboards:

[InfosecGoon]

Have you considered updating to SO 2.3.200? It includes an update to Elastic 8.5, which might help if this is just a bug in the older version.

[dgmyr]

Hello, unfortunately the problem persists after upgrading to version 2.3.200

[InfosecGoon]

Does your Kibana account have appropriate privileges for this task?

[dgmyr]

Hi, my account has superuser role in SO

[agoerl]

Same here, but still on 2.3.190.

I never did this before so there might be just some basic prequisites/configurations missing. E.g. enabling painless processing using script.painless.regex.enabled : true?

[dgmyr]

Hello, unfortunately after modifying the elasticsearch config the problem persists.
Here is the screenshot with added parameters:

[agoerl]

Hello,

I could workaround this problem by modifying the index template. I added a new component template which in my case does the same job. My component template looks like this:

PUT _component_template/myComponentTemplateWithAPainlessScript
  "template": {
    "mappings": {
       "runtime": {
        "MyNewRuntimeField" : {
           "type": "keyword",
	   "script": {
	         "source": """
                              emit("Hello World!));
		   } """
               }
	   }
      }
  }  
  }
}

[dgmyr]

Hi, how can i apply this component template to default data view :so- ? Thanks

[agoerl]

I am not sure. I just applied it to so-ossec by editing this index template and add it in the "component templates" step. You could try to add it to so-common, since it has "so-*" as pattern. But that is just a guess.

[dgmyr]

Hi, you`ve added runtime field in both settings of index templates and component templates or only in one of them?
This activity should be done in Kibana or in files in /opt/so/saltstack/default/salt/elasticsearch/templates/ ?
Thanks