A way better than rollup and transform

Elastic Stack Elasticsearch
1

Hi there,
Thanks a lot for your great and wonderful support team!

At first step we use rollup jobs for create hourly and daily aggregation of our data,
but rollup indices dont support ILM! unfortunately.

At second step we use transforms for do same things, but when our field contains NULL value and we use it in GroupBy section the output of transform is NULL and empty!

is there any way to solve these problems? or is there a new way for aggregate stream data into another indices hourly and daily ?

2

Regarding your transform configuration:

Per default documents with null values are ignored, however you can change this behavior if you set missing_bucket to true, see this example.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.