Aggregat about data

Elastic Stack Logstash
1

Hello,

I search to put aggregat on my data.

Here a party of my data :

TYPE	Usage
FREEUSER	345
PREMIUM_USER	8653
FREEUSER	1369
FREEUSER	87654
PREMIUM_USER	43678
FREEUSER	8654
PREMIUM_USER	2387
FREEUSER	98723
FREEUSER	45873
PREMIUM_USER	2847
PREMIUM_USER	89235
USER_UNKNOW	16235
USER_GOLD	32457

My aim is :

To sum Usage by type of client, example :

For user no gold, i want know the sum of usage :

So, USER_PREMIUM & FREEUSER, USER_UNKNOW have use a total of 405 653 octets.

Currentl, in kibana when i test this, i have the sum of usage by type of user :confused:

2

I thought that in filter of logstash :

if [TYPE] == "FREEUSER or PREMIUMUSER or UNKNOW_USER" {
aggregate {
task_id => "%{taskid}"
code => "map['USAGE'] ||= 0 ; map['USAGE'] += event.get('USAGE_no_gold')"
}
}

What do you think

3

In general I suggest you perform aggregations in Elasticsearch (typically via Kibana), not Logstash. The Kibana group can give suggestion for how to solve your problem.

4

I have also see, we can parameter this in Kibana with devtool ?

{
"query" : {
"constant_score" : {
"filter" : {
"match" : { "TYPE" : "PREMIUMUSER, FREEUSER, UNKNOW_USER" }
}
}
},
"aggs" : {
"sum_no_gold_user" : { "sum" : { "field" : "USAGE" } }
}
}

Can you explain me the difference between solutions ?

5

aha Thank you @magnusbaeck i put the question simultaneous

6

@magnusbaeck Sorry but, you seem a hero of ELK Stack.

What do you think about painless scripted field ? Is deprecated no ?

I find use of DevTool more intuitive.

Here a proposed solution:
f068d89d03b54ebc23934c13529cfde7e2e4cf1b_1_678x500

7

Painless was introduced in ES 5.0 and has not been deprecated.

8

thank you @magnusbaeck you are amazing.

To close this topic, we must wait 1 month ?

See you soon

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.