How can I call "extended_stats" in Elasticsearch 6.4.0 SQL syntax

[jam1142 (JQ)]

I am excited to hear elasticsearch giving option to write query in SQL syntax but just curious about how can we achieve elasticsearch features like aggregate "extended_stats" through SQL syntax. I am looking for standard deviation.

[Andrei_Stefan]

Hi @jam1142,
What do you mean by "aggregating extended_stats"? If you could explain a bit the use case (not necessarily in technical terms, but more like business usage or user needs), that would help.

Thanks.

[jam1142 (JQ)]

See below in DSL syntax which i am asking for SQL

{
"size": 0,
"aggs": {
"std Batch Requests per sec": {
"filter": {
"term": {
"counter_name.keyword": "Batch Requests per sec"
}
},
"aggs": {
"stats_value": {
"extended_stats": {
"field": "counter_value"
}
}
}
}
}
}

[Andrei_Stefan]

@jam1142 you won't get the output like ES would give it to you, but there are functions we support that have values extracted from extended_stats. Please see this section of the documentation for those functions.

[jam1142 (JQ)]

Thenka Andrei. I am facing another problem please see if you can help me on this. Here is the link

How can I check index exists in logstash filter and how can get dynamic field from elasticsearch lookup( in filter plugin)

Q1: How can i check index exists in "Elasticsearch filter plugin". My situation is taht i am getting old data from elasticsearch to subtract from current record but in case if that index doesn't exist then i want to subtract 0. Currently Its throwing error if index doesn't exist. I need to know how can i check if index exist in elasticsearch filter so i can handle it. Q2: Is there a way to do get filter lookup field by dynamic name like elasticsearch { hosts => "localhost:9200" index => "pt…

[Andrei_Stefan]

No problem @jam1142. Unfortunately, I am not familiar enough with the filter plugin in Logstash and it's better to wait for someone monitoring that section to help you further.

[jam1142 (JQ)]

Thanks Andrei.