Summary
runtime_mappings is accepted by Elasticsearch as a top-level field on _update_by_query request bodies (alongside query and script), but it is missing from the specification. Because the JS client (and other generated clients) derive their types from this spec, users cannot type-safely pass runtime_mappings to updateByQuery today.
This was surfaced by the Security Solution team who are using runtime fields in the query's filter context via _update_by_query.
What needs to change
Add runtime_mappings to the UpdateByQueryRequest type in the specification (same field type already used on SearchRequest).
Current workaround
Until a client patch is cut, users can work around the missing type by casting the body:
client.updateByQuery({
index: 'my-index',
body: { runtime_mappings: { ... }, query: { ... }, script: { ... } } as any
})
Summary
runtime_mappingsis accepted by Elasticsearch as a top-level field on_update_by_queryrequest bodies (alongsidequeryandscript), but it is missing from the specification. Because the JS client (and other generated clients) derive their types from this spec, users cannot type-safely passruntime_mappingstoupdateByQuerytoday.This was surfaced by the Security Solution team who are using runtime fields in the query's filter context via
_update_by_query.What needs to change
Add
runtime_mappingsto theUpdateByQueryRequesttype in the specification (same field type already used onSearchRequest).Current workaround
Until a client patch is cut, users can work around the missing type by casting the body: