Certain question on rollups

Elastic Stack Elasticsearch
1

Hey all,

I have a few questions on rollup jobs. Mind that we are new to ES so please bear with me.

1.I wanted to understand the effect of settings certain index fields to index: false when there are certain rollup jobs that aggregate against those fields.
Example: field: cpu_time set to index = false. Can I create a rollup job that aggregates to average cpu_time per hour?

  1. Can I set field names for rollup indices? Like in the example above. Can I set the name of the average cpu_time somehow.

Thanks
Y

2

Welcome! :smiley:

  1. Not indexing a field means it won't be searched against, which won't impact a rollup.
  2. Good question! You could try specifying a mapping (or template) and then applying an alias. I haven't tried it though, so that's more an educated guess.
3

Hi Mark

Thanks a lot for taking the time to answer my questions!

Let me elaborate a bit on my second question and explain why an alias won't work. I have two indices of raw data. I want to aggregate data from these indexes into a roll-up index.

Example:

Index 1: pageviews (website, page, timestamp)
Index 2: purchases (website, product, timestamp)

These above indexes have hundreds of thousands of events a day

I want to create a roll-up with one document per website per dat

website_totals (website, timestamp, first_pageview, last_pageview, total_pageviews, first_purchase, last_purchase, total_purchases)

The complexity for me comes because the total_pageviews and total_purchases fields are derived using the same formula on the same field but on different indexes (count of timestamp). If I am not able to name them differently like in my example one will end up overwriting the other

Thanks

4

Ahh ok. Why do you want them in a single index?

5

Cause we commonly query all these things together and two queries sounded like an overkill.

Maybe too used to sql DBA ?

6

Heh, that's a pretty succinct summary tbh. I wouldn't even worry about it.

And even if they're in separate indices, you can still query them both at the same time, eg "show me all stats in this timeframe".

7

Thanks Mark

You are super helpful!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.