# Rolling up Data Streams
**URL:** https://discuss.elastic.co/t/rolling-up-data-streams/288328
**Category:** Elasticsearch
**Tags:** rollups, datastreams
**Created:** [November 3, 2021, 1:04pm UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328 "2021-11-03T13:04:31Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@seanziee](https://discuss.elastic.co/u/seanziee)
#### Post date: [November 3, 2021, 1:04pm UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/1 "2021-11-03T13:04:32Z")
Hi there,
I'm curious if making rollups from data streams is recommended/possible? It would be great after rolling over data from my data stream if I could also roll it up into bigger time chunks.
Thanks!
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 4, 2021, 12:11am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/2 "2021-11-04T00:11:18Z")
It's certainly possible, recommending it or not will depend on what you are trying to achieve 🙂
---
### Author:  [@seanziee](https://discuss.elastic.co/u/seanziee)
#### Post date: [November 4, 2021, 9:33am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/3 "2021-11-04T09:33:55Z")
My goal is to use data streams for my metricbeat data and then after 7 days or so, have the 10s data roll up to 30 min data. I want to have my dashboards to query both the rolled up data as well as the current data.. so when looking at the past 2 weeks, data will show for the entire span and because the buckets will be larger, the 30 min data will still show up just like the more recent data.
From the documentation, it seems that you can only call one rollup at a time which concerns me because I will have data streams from metricbeat that create indices for each module (and I also have several different types of machine that ingest metricbeat that create separate indices). i.e.
metrics-system.cpu-prod-companyA, metrics-system.network-prod-companyA
metrics-system.cpu-prod-companyB, metrics-system.network-prod-companyB
So would I only be able to search either A or B when looking at rollups? Would I need to combine all the different company metrics in the same datastream i.e.
metrics-system.cpu-prod-companyAandcompanyB, system.network-prod-companyAandcompanyB
Also how are the multiple underlying .ds indices dealt with for rollups?
---
### Author:  [@seanziee](https://discuss.elastic.co/u/seanziee)
#### Post date: [November 11, 2021, 7:26am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/4 "2021-11-11T07:26:01Z")
Any thoughts @warkolm ?
---
### Author:  [@seanziee](https://discuss.elastic.co/u/seanziee)
#### Post date: [November 23, 2021, 6:57pm UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/5 "2021-11-23T18:57:49Z")
bump
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 24, 2021, 1:40am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/6 "2021-11-24T01:40:58Z")
Can you share one of the rollup jobs you have configured for this?
---
### Author:  [@seanziee](https://discuss.elastic.co/u/seanziee)
#### Post date: [December 11, 2021, 4:39am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/7 "2021-12-11T04:39:15Z")
```auto
PUT _rollup/job/test_rollupA
{
"id": "test_rollupA",
"index_pattern": "test-metricbeat-companyA*",
"rollup_index": "test-metricbeat_companyA-rollup",
"cron": "0 0 0 * * ?",
"page_size": 1000,
"groups": {
"date_histogram": {
"interval": "60m",
"delay": "7d",
"time_zone": "UTC",
"field": "@timestamp"
},
"terms": {
"fields": [
"container.id.keyword",
"container.image.name.keyword",
"container.name.keyword",
"container.runtime.keyword"
]
}
},
"metrics": [
{
"field": "docker.cpu.system.ticks",
"metrics": [
"avg"
]
},
{
"field": "docker.cpu.total.norm.pct",
"metrics": [
"avg",
"max",
"min",
"sum",
"value_count"
]
}
]
}
```
```auto
PUT _rollup/job/test_rollupB
{
"id": "test_rollupB",
"index_pattern": "test-metricbeat-companyB*",
"rollup_index": "test-metricbeat_companyB-rollup",
"cron": "0 0 0 * * ?",
"page_size": 1000,
"groups": {
"date_histogram": {
"interval": "60m",
"delay": "7d",
"time_zone": "UTC",
"field": "@timestamp"
},
"terms": {
"fields": [
"container.id.keyword",
"container.image.name.keyword",
"container.name.keyword",
"container.runtime.keyword"
]
}
},
"metrics": [
{
"field": "docker.cpu.system.ticks",
"metrics": [
"avg"
]
},
{
"field": "docker.cpu.total.norm.pct",
"metrics": [
"avg",
"max",
"min",
"sum",
"value_count"
]
}
]
}
```
---
### Author:  [@seanziee](https://discuss.elastic.co/u/seanziee)
#### Post date: [December 11, 2021, 6:21am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/8 "2021-12-11T06:21:24Z")
Sorry for the delay and thanks for getting back to me. I posted the above for you to see.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2022, 6:22am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328/9 "2022-01-08T06:22:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.