Configuring elastic-search to store certain aggregations and use pre-computed aggregations to respond to queries?



I have been looking around for a couple weeks for this and I can't figure out how I might do it. I am using Elasticsearch as a TSDB. When I am using Kibana and I want to look at a bunch of data over a period of a day, for example, it seems like Elasticsearch is aggregating it on the fly starting from all the per-second logs. The preferred behavior would be to have some pre-computed hourly or ten-minute aggregations of a certain kind, for example, and have Elasticsearch be smart enough to use those precomputed aggregations when responding to queries for a field. I still want the high-resolution data available for when I want to zoom in on a shorter time period.

Clearly, I could do something like this manually where I periodically run aggregation queries for $FIELD and store the result in something like $FIELD_hourly or $FIELD_daily. Is there a way to do this that doesn't require me to have separately-named fields of varying resolutions? The issue is that I would need to have separate visualizations in Kibana that query the correct field name based on the time period the visualization is designed for.

Thank you!

(Mark Walkom) #2

Yes, that is what it does.

Not at this point.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.