Elastic input does NOT support aggs?

[Sjaak01 (Sjaak)]

Hi,

Can somebody confirm whether Logstash 6.6 (or higher) and the elasticsearch input support aggs?

I'm on 6.6 and while normal queries work, aggs do not. Other topic over the years talk about the same issue and in all cases it appears aggs are not supported after logstash 2.1 or something because the scoll option messes with aggs queries and on later versions there is no option to disable scroll.

If aggs are not supported this should be clearly indicated on the docs page as there currently is no mention about any limitations at all.

[pastechecker (Charlie)]

@Sjaak01

d on later versions there is no option to disable scroll.

What does your
output {

stdout { codec => rubydebug }

}

say?

[Sjaak01 (Sjaak)]

It just pulls all the documents from the specified indeces. So it appears the whole query is just ignored.

It is not a configuration issue either as other, non aggs queries, work fine.