Aggregation of log time-series - median per minute?

Elastic Stack Logstash
1

Hi,

I am facing the problem that I have high throughput JSON logs. I don't want to store the logs with that accuracy, but the sender is not configurable.

I wonder if Logstash can do something for me to calculate the median of all logs per minute on a chosen field. And instead of forwarding all the Logs to Elasticsearch, it could write one log-line per minute.

Is there any times series aggregation in Logstash for that?

Best,
Marius

2

Would the aggregate filter be helpful?

1 Like
3

Absolutely... I just did not find this in my google searches (wrong terms I guess). Thank you very much.