Logstash - aggregation_fields in elasticsearch filter plugin

Hello,

I am trying to use elasticsearch filter plugin in logstash.
My logstash file:

filter {
elasticsearch {
hosts => "XXX"
index => "logs_0"
query => "query.json"
aggregation_fields => { "value_avg" => "AVG"}
}
}

And, in my query I create an aggregation named value_avg. What can be wrong?
The result of my aggregation is like this:
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 649,
"max_score" : 0.0,
"hits" :
},
"aggregations" : {
"value_avg" : {
"value" : 472.545088887031
}
}
}

We found the solution. In the elasticsearch filter plugin we need to use query_template and not query, since we are using a query in a file.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.