# Elasticsearch query in Logstash config file for aggregation and re-indexing not working

**URL:** <https://discuss.elastic.co/t/elasticsearch-query-in-logstash-config-file-for-aggregation-and-re-indexing-not-working/151591>\
**Category:** Logstash\
**Created:** [October 9, 2018, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-query-in-logstash-config-file-for-aggregation-and-re-indexing-not-working/151591 "2018-10-09T09:27:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dx123](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@dx123](https://discuss.elastic.co/u/dx123)\
**Post date:** [October 9, 2018, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-query-in-logstash-config-file-for-aggregation-and-re-indexing-not-working/151591/1 "2018-10-09T09:27:21Z")

</div>

I have data that is already indexed and now I want to perform some querying and aggregating to re-index the data into smaller specific indices. However I have trouble writing the Elasticsearch query where I just want to retrieve all values of the IP field, get the count of how many times each IP showed up in my data and thereafter store them in a new index. When I view the new index in Kibana, all fields are still showing up which I do not want.

Here is my Logstash config file code:

```
input {
  elasticsearch {
    hosts => "localhost:9200"
    index => "Old_Index"	
    query => '{
	"_source": "ip.keyword",
	"size": 0,
	"query": {
		"bool": {
			"must": [{
				"match_all": {}
			}]
		}
	},
	"aggs": {
		"by ip": {
			"terms": {
				"field": "ip.keyword"
			},
			"aggs": {
				"ip_count": {
					"value_count": {
						"field": "ip.keyword"
					}
				}
			}
		}
	}
	}'
	}
}					

output { 
  elasticsearch { 
    hosts => "localhost:9200"
    index => "NewIndex" 
  }
}

```

Still very new to this, any help is appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2018, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-query-in-logstash-config-file-for-aggregation-and-re-indexing-not-working/151591/2 "2018-11-06T09:27:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.