Null aggregation response from logstash elastic search filter while in Kibana its good

Hi,
I am running below query from Kibana (6.0.0) and its showing result but same when I am running through logstash Elastic search filter plug in query dsl template json its not returning any result.

Query.DSL:
{
"size": 0,
"_source": {
"excludes": []
},
"query" : {
"match" : {
"JobId" : "96"
}
},
"aggs" : {
"1": {
"top_hits": {
"docvalue_fields": ["Status.keyword"],
"_source": {"includes": [ "Status","Status.keyword"]},
"track_scores":true,
"size":1,
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
}

		}

}

While when i run it though kibana its giving result as below

{
"took": 1,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 0,
"hits": []
},
"aggregations": {
"1": {
"hits": {
"total": 3,
"max_score": 1,
"hits": [
{
"_index": "logstash_jobs_inservice-2018.05.18",
"_type": "doc",
"_id": "naQDc2MBHF2ELB4FKN1D",
"_score": 1,
"_source": {
"Status": "Completed"
},
"fields": {
"Status.keyword": [
"Completed"
]
},
"sort": [
1526627439510,
1
]
}
]
}
}
}
}

Actually I want Status 'Started' or Completed in logstash elastic search Filter plug in. Can you please help on this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.