Using anomaly detection on runtime fields
In some cases, it might be necessary to analyze the value of a field that doesn't exist in the index mappings but can be calculated dynamically from other field values. This capability to dynamically define field values has existed for quite some time in Elasticsearch as script fields, but starting in v7.11, script fields are replaced by an updated concept known as runtime fields. In short, runtime fields are treated like first-class citizens in the Elasticsearch mapping (if defined there) and will eventually allow the user to promote a runtime field into an indexed field.
Users can define runtime fields in the mapping or only in the search request. It is good to note that at the time of writing, there is no support for definitions of runtime fields in the data feed of an anomaly detection job. However, if the runtime fields are defined in the mappings, then the anomaly detection job can leverage them seamlessly.