# Logstash elasticsearch plugin

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-plugin/39578>\
**Category:** Logstash\
**Created:** [January 19, 2016, 6:04pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin/39578 "2016-01-19T18:04:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![venky1987](https://avatars.discourse-cdn.com/v4/letter/v/e56c9b/32.png) [@venky1987](https://discuss.elastic.co/u/venky1987)\
**Post date:** [January 19, 2016, 6:04pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin/39578/1 "2016-01-19T18:04:07Z")

</div>

Hi,

I m trying to use elasticsearch input plugin in logstash (logstash 2.1.1) to aggregate data based on time. A sample logstash config is given below:

input {  
elasticsearch {  
hosts =\> "localhost"  
index =\> "abc"  
scan =\> false  
size =\> 0  
query =\> '{  
"aggs": {  
"range": {  
"date\_range": {  
"field": "date",  
"format": "MM-yyy",  
"ranges": [  
{ "to": "now-10M/M" },  
{ "from": "now-10M/M" }  
]  
}  
}  
}  
}'  
}  
}

output {  
stdout { codec =\> rubydebug }  
}

when i run the logstash with this configuration file i am expecting an output as below:  
{  
...

```
"aggregations": {
    "range": {
        "buckets": [
            {
                "to": 1.3437792E+12,
                "to_as_string": "08-2012",
                "doc_count": 7
            },
            {
                "from": 1.3437792E+12,
                "from_as_string": "08-2012",
                "doc_count": 2
            }
        ]
    }
}

```

}  
However, this is not the case as i do not get to see any aggregated data on the screen(default sysout).  
Note: works in case of curl request or in sense plugin.

Also when i run with the same config with out size =\> 0, it returns only the documents that fall under the mentioned time buckets and not the aggregations as shown in the output above.

Am i missing something here or is this a bug ?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin/39578/2 "2017-07-06T05:15:11Z")

</div>