# Logstash - aggregation\_fields in elasticsearch filter plugin

**URL:** <https://discuss.elastic.co/t/logstash-aggregation-fields-in-elasticsearch-filter-plugin/164672>\
**Category:** Logstash\
**Created:** [January 17, 2019, 3:37pm UTC](https://discuss.elastic.co/t/logstash-aggregation-fields-in-elasticsearch-filter-plugin/164672 "2019-01-17T15:37:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Francisca\_Lima](https://avatars.discourse-cdn.com/v4/letter/f/edb3f5/32.png) [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)\
**Post date:** [January 17, 2019, 3:37pm UTC](https://discuss.elastic.co/t/logstash-aggregation-fields-in-elasticsearch-filter-plugin/164672/1 "2019-01-17T15:37:44Z")

</div>

Hello,

I am trying to use elasticsearch filter plugin in logstash.  
My logstash file:

> filter {  
> elasticsearch {  
> hosts =\> "XXX"  
> index =\> "logs\_0"  
> query =\> "query.json"  
> aggregation\_fields =\> { "value\_avg" =\> "AVG"}  
> }  
> }

And, in my query I create an aggregation named value\_avg. What can be wrong?  
The result of my aggregation is like this:  
{  
"took" : 0,  
"timed\_out" : false,  
"\_shards" : {  
"total" : 5,  
"successful" : 5,  
"skipped" : 0,  
"failed" : 0  
},  
"hits" : {  
"total" : 649,  
"max\_score" : 0.0,  
"hits" :   
},  
"aggregations" : {  
"value\_avg" : {  
"value" : 472.545088887031  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Francisca\_Lima](https://avatars.discourse-cdn.com/v4/letter/f/edb3f5/32.png) [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)\
**Post date:** [January 17, 2019, 6:14pm UTC](https://discuss.elastic.co/t/logstash-aggregation-fields-in-elasticsearch-filter-plugin/164672/2 "2019-01-17T18:14:06Z")

</div>

We found the solution. In the elasticsearch filter plugin we need to use query\_template and not query, since we are using a query in a file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2019, 6:14pm UTC](https://discuss.elastic.co/t/logstash-aggregation-fields-in-elasticsearch-filter-plugin/164672/3 "2019-02-14T18:14:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.