Logstash - Elastic search input plugin - Aggregation query doesn't seem to work

[Kyle_Ryan]

I have the same issue. It seems to be related the behavior of the scroll api with respect to aggregations.
It would appear from the docs that this plugin uses a scroll query, which does not play nice with aggregations. In 2.3 and earlier you could choose whether you wanted the query to be executed as an ordinary query, or as a scan and scroll via the "scan" parameter.

elasticsearch | Logstash Reference [2.3] | Elastic

But support for that was dropped in 2.4.

It is worth noting that this question has been asked many times before.
2017:

ES Aggregation as Logstash Input

I found 2 topics on this topic with no clear solution. I eventually got it working. How to get ES aggregation data as Logstash input? Aggregation Query possible input ES plugin I basically used the curl to output ES aggregate query to file and then used file input to read and convert to csv. But same can be done to send aggregate data to ES as a new index. input { pipe { codec => "json" command => "./ord_summary_curl.sh" } } filter { split { field => "[aggregations][by-dat…

2016:

How to get ES aggregation data as Logstash input?

I have a Logstash configuration with the 'elasticsearch' input. input { elasticsearch { hosts => "localhost" index => "logstash-*" type => 'aggregation_metric' size => 0 query => ' { "size": 0, "aggs": { ... here is multi-level aggregation without buckets } }' I'm trying to send aggregation result as a new document in new index of ES. I don't need any documents from the root level of searching, but maybe some of documents fro…

2015:

Aggregation Query possible input ES plugin

I really want to know that aggregation is possible in input / output plugin ? input { Read all documents from Elasticsearch matching the given query elasticsearch { hosts => ["192.168.1.5"] index => "matching_score_log" type => "keyword_score" port => 9200 size => 0 docinfo => true scan => false query => '{"aggs":{"terms_keyword":{"terms":{"field":"user_keyword","size":0},"aggs":{"key_score":{"terms":{"field":"inquiry_id","size":0},"aggs":{"key_score":{"sum":{"field":"inquiry_score"…

There's even an open issue for it.

Support Aggregations

For now your best bet is probably to use one of the workarounds suggested with bash/php in previous questions. Or you could try and write up a PR to address the issue.

Not sure if anyone else has news on support for elastic aggregations within the elastic input plugin, it's a sorely needed feature to be sure.