Elastic Transforms - continous mode is not detecting changes

[Hendrik_Muhs]

@catrexis

I originally wanted to use 30minutes, but I noticed that only 1 minute or 1 hour is supported but nothing in between, right?

You are using calendar_interval, to use 30 minutes you have to use fixed_interval, more details in the docs.

@catrexis

So if the state of one document changes to ERROR, the document is still being counted in the transformed index.

That's because you filtered these documents in the query. The query is applied at the very beginning, making it impossible for transform to take ERROR into account.

In order to let transform see the errors, you have to apply the filter as part of aggregations:

"aggregations": {
      "order_count" : {
          "filter": {
            "bool": {
              "must_not":[
               {"term":{"content.state":"ERROR"}}
              ]
          }
      }
  }
}