# Indexing Aggregate Results

**URL:** <https://discuss.elastic.co/t/indexing-aggregate-results/202528>\
**Category:** Logstash\
**Created:** [October 7, 2019, 12:35pm UTC](https://discuss.elastic.co/t/indexing-aggregate-results/202528 "2019-10-07T12:35:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Artisanal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artisanal/32/55481_2.png) [@Artisanal](https://discuss.elastic.co/u/Artisanal)\
**Post date:** [October 7, 2019, 12:35pm UTC](https://discuss.elastic.co/t/indexing-aggregate-results/202528/1 "2019-10-07T12:35:03Z")

</div>

Hi all,

I'm attempting to use the Logstash elasticsearch input to perform an aggregating query against the auditbeat index, add some metadata to the results, then send them back to Elasticsearch using the elasticsearch Logstash output.

My issue is that, instead of sending the results of the aggr (plus an add\_fields mutation) to the new index, I'm receiving the full events (plus an add\_fields mutation).

As an example - I'd like to index:

username = bob  
failed logins = 500  
my\_tag = failed logins

What I'm currently receiving in the new index is all 500 failed login attempts by bob, with the correct value for my\_tag.  
I thought that "size" : 0 would stop things from returning each results (this gives the desired result in the dev console), but apparently not.

{  
"size": 0,  
"aggs": {  
"per\_user": {  
"terms": {  
"field": "user.name",  
"min\_doc\_count": 10  
}  
}  
},

Has anybody experienced something similar before?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2019, 12:35pm UTC](https://discuss.elastic.co/t/indexing-aggregate-results/202528/2 "2019-11-04T12:35:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.