Apply Composite Aggregation on Filtered Data

[Srinivas_AR (Srinivas)]

I'm using "Composite Aggregation" as my use case requires "Pagination" on buckets returned by Aggregation, as the number of returned buckets could be huge.

I also need to run "Composite aggregation" on a specific time range, I'm using a "range" filter for this. However, the response from elasticsearch does not contain any data in "aggregations". "hits" array does contain proper data as per filter. I'm only interested in the result of "Composite Aggregation".

Am I missing something?

Request is as below :

GET <my-index>/_search 
{
  "query" : {
    "range" : {
      "@timestamp" : {
        "gte" : "2020-03-29T14:53:42.068Z",
        "lt" : "2020-03-29T15:53:42.068Z"
      }
    }
  },
  "aggs" : {
    "uniq_userids": {
      "composite" : {
        "size": 100,
        "sources" : [
          { "by_userid": { "terms" : { "field": "userid.keyword" } } }
        ]
      }
    } 
  } 
}

Response is as below :**

{
  "took" : 10,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 12,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
          ...
    ]
  },
  "aggregations" : {
    "uniq_userids" : {
      "buckets" : [ ]
    }
  }
}

Expected output in aggregations element

"aggregations" : {
    "uniq_userids" : {
      "after_key" : {
        "by_userid" : "user4"
      },
      "buckets" : [
        {
          "key" : {
            "by_userid" : "user1"
          },
          "doc_count" : 3
        },
        {
          "key" : {
            "by_userid" : "user2"
          },
          "doc_count" : 3
        },
        {
          "key" : {
            "by_userid" : "user3"
          },
          "doc_count" : 2
        }
      ]
    }
  }

[Srinivas_AR (Srinivas)]

I was able to debug the issue. Issue was in logstash patterns. I was storing userid value in a different field.