# Logstash aggregate query

**URL:** <https://discuss.elastic.co/t/logstash-aggregate-query/107827>\
**Category:** Logstash\
**Created:** [November 15, 2017, 9:04pm UTC](https://discuss.elastic.co/t/logstash-aggregate-query/107827 "2017-11-15T21:04:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pratiksha\_Tewary](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Post date:** [November 15, 2017, 9:04pm UTC](https://discuss.elastic.co/t/logstash-aggregate-query/107827/1 "2017-11-15T21:04:05Z")

</div>

Hi,

We are trying to implement the aggregate query in Logstash using the Elasticsearch input plugin and have the following in our input portion of the Logstash configuration:

```
input {
  elasticsearch {
    hosts => "<host>" 
    
	user => "<username>"
    password => "<password>"	
     index => "students"
    query => '{
    "query" : {
        "constant_score" : {
            "filter" : {
                "match" : { "name" : "Vinoth" }
            }
        }
    },
    "size": 0,
  "aggs": {
    "Vinoth_avg_marks": {
       "avg" : { "field" : "mark" } 
    }
  }
  }' 
	size => 100 
    scroll => "100m" 
    docinfo => true
	#add_field => {"Vinoth_avg_marks" => "%{[aggs][Vinoth_avg_marks][value]}"}
  }
}

```

We want to find the average scores of the person "Vinoth". When we tried to implement this in the Kibana Dev tools, we were getting the correct result. However, the result was only achieved in the "aggregations" object. We noticed that Logstash only returns the contents of the "hits" object. Is it possible to return the contents of the "aggregations" object as well? If so, how? This question has also been raised here: [Aggregation Query possible input ES plugin](https://discuss.elastic.co/t/aggregation-query-possible-input-es-plugin/28159) .  
A response will be much appreciated. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Pratiksha\_Tewary](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Post date:** [November 20, 2017, 6:48pm UTC](https://discuss.elastic.co/t/logstash-aggregate-query/107827/2 "2017-11-20T18:48:49Z")

</div>

Any update?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2017, 6:49pm UTC](https://discuss.elastic.co/t/logstash-aggregate-query/107827/3 "2017-12-18T18:49:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.