Hi
I'm trying to start a transform but keep getting errors and turns the cluster's state into red (sooooo... frustrating )
last message on Kinana is "Created transform."
Any help will be appreciated (removing the painless script doesnt help)
PUT _transform/daily
{
"source": {
"index": [
"metrics-*"
],
"query":
{
"bool": {
"must": [
{
"range": {
"datetime": {
"gte": "now-3d"
}
}
},
{
"exists": {
"field": "value"
}
}
]
}
}
},
"settings":{
"docs_per_second":500
},
"pivot": {
"group_by": {
"clientname": {
"terms": {
"script": {
"source": "if (doc.containsKey('clientname.keyword')) { return doc['clientname.keyword'].value} else { return doc['clientname'].value}"
}
}
},
"servername": {
"terms": {
"field": "servername"
}
},
"category": {
"terms": {
"field": "category"
}
},
"counter": {
"terms": {
"field": "counter"
}
},
"instance": {
"terms": {
"field": "instance"
}
},
"datetime": {
"date_histogram": {
"field": "datetime",
"calendar_interval": "1d"
}
}
},
"aggregations": {
"clientid": {
"max": {
"field": "clientid"
}
},
"avg_value": {
"avg": {
"field": "value"
}
},
"percentiles_value": {
"percentiles": {
"field": "value",
"percents": [
4,
11,
90,
97
]
}
},
"min_value": {
"min": {
"field": "value"
}
},
"max_value": {
"max": {
"field": "value"
}
}
}
},
"dest": {
"index": "daily"
},
"frequency": "1h",
"sync": {
"time": {
"field": "datetime",
"delay": "1h"
}
}
}
