# Exporting aggregated data out of ES

**URL:** <https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856>\
**Category:** Logstash\
**Created:** [May 16, 2017, 6:01am UTC](https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856 "2017-05-16T06:01:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pavant](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@pavant](https://discuss.elastic.co/u/pavant)\
**Post date:** [May 16, 2017, 6:01am UTC](https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856/1 "2017-05-16T06:01:06Z")

</div>

## I am trying to export aggregared data out of Elasticsearch using log stash input. Below is my code. But I am getting a error. Can anyone help me? My code in Logstash.conf

input {  
elasticsearch {  
hosts =\> "localhost"  
index =\> "ipfix-5min-20170512"  
type =\>"agg"  
query =\> '  
{  
"query": { "match": { "dstPt": "53"} },  
"aggs": { "sum\_by\_hr": { "date\_histogram": { "field": "flStDttmUtc", "interval": "1h", "time\_zone": "America/New\_York", "min\_doc\_count": 1 } } }  
}'  
size =\> 500  
scroll =\> "5m"  
docinfo =\> true  
}  
}

output {  
elasticsearch {  
index =\> "ipfix-5min-20170512\_1hr"  
document\_id =\> "%{[@metadata][\_id]}"  
}  
}

## Error :

Error: [400] {"error":{"root\_cause":[{"type":"illegal\_argument\_exception","reason":"Failed to parse request body"}],"type":"illegal\_argument\_exception","reason":"Failed to parse request body","caused\_by":{"type":"json\_parse\_exception","reason":"Unrecognized token 'DnF1ZXJ5VGhlbkZldGNoBQAAAAAAAArsFm5KTF9hcy1TUUgtd3dnbjBPUzl0QkEAAAAAAAA': was expecting ('true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@1a9cfbc1; line: 1, column: 73]"}},"status":400}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 16, 2017, 6:15am UTC](https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856/2 "2017-05-16T06:15:50Z")

</div>

Known bug, fixed in logstash-input-elasticsearch v4.0.3.

> <https://github.com/logstash-plugins/logstash-input-elasticsearch/issues/62>

---

<div class="post-metadata">

**Author:** ![pavant](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@pavant](https://discuss.elastic.co/u/pavant)\
**Post date:** [May 16, 2017, 7:22am UTC](https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856/3 "2017-05-16T07:22:00Z")

</div>

Thanks for the response. I am using ES 5.3 and logstash 5.4.0. But I am still facing the issue. ☹ not sure if cam missing something

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 16, 2017, 8:10am UTC](https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856/4 "2017-05-16T08:10:30Z")

</div>

And you've verified that you indeed are running v4.0.3 of the logstash-input-elasticsearch plugin?

---

<div class="post-metadata">

**Author:** ![pavant](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@pavant](https://discuss.elastic.co/u/pavant)\
**Post date:** [May 16, 2017, 7:24pm UTC](https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856/5 "2017-05-16T19:24:43Z")

</div>

Thanks a lot it is working .I was using 4.0.2 and i upgraded it to 4.0.3.  
But my output to elasticsearch in not aggregated. Should i change my logstash-output-elasticsearch plugin also?  
By current version is logstash-output-elasticsearch (6.3.0).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2017, 7:25pm UTC](https://discuss.elastic.co/t/exporting-aggregated-data-out-of-es/85856/6 "2017-06-13T19:25:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.