Dear all, I am facing issues creating a rollup job for big indexes. While saving it gives me a exception "Request failed with a 400 error. [x_content_parse_exception] Failed to build [xpack/rollup/jobconfig] after last required field arrived".
Please help in this case.
PUT _rollup/job/singleapp-nginx-rolled
{
"id": "singleapp-nginx-rolled",
"index_pattern": "singleapp-nginx-*",
"rollup_index": "singleapp-nginx-rolled",
"cron": "0 20 * * * 0",
"page_size": 1000,
"groups": {
"date_histogram": {
"interval": "60m",
"delay": "1d",
"time_zone": "UTC",
"field": "@timestamp"
},
"terms": {
"fields": [
"fileset.name.keyword",
"host.hostname.keyword",
"nginx.access.response_code.keyword"
]
}
},
"metrics": [
{
"field": "@timestamp",
"metrics": [
"value_count"
]
}
]
}