I have a very trivial doubt, when i read log files and send this to elasticsearch via filebeat and logstash, sp while doing aggregations and performing operations like sum, average does it read the log file before aggregating it or it has created a time series graph for itself and then present the data?
the contents of a log file are stored in elasticsearch for effecient retrieval of those aggregations, thus the original log file is not needed to execute an aggregation, as all the data is already within Elasticsearch.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.