Rollup Index is Empty


(Christian Saide) #1

I have added a new rollup job:

{
  "config": {
    "id": "testing-rollups",
    "index_pattern": "metricbeat-*",
    "rollup_index": "rollup-works",
    "cron": "0 * * * * ?",
    "groups": {
      "date_histogram": {
        "interval": "60s",
        "field": "@timestamp",
        "time_zone": "UTC"
      },
      "terms": {
        "fields": [
          "host.name",
          "system.process.name"
        ]
      }
    },
    "metrics": [
      {
        "field": "system.process.cpu.total.pct",
        "metrics": [
          "avg",
          "max",
          "min"
        ]
      },
      {
        "field": "system.process.memory.rss.pct",
        "metrics": [
          "avg",
          "max",
          "min"
        ]
      }
    ],
    "timeout": "20s",
    "page_size": 1000
  },
  "status": {
    "job_state": "started",
    "current_position": {
      "@timestamp.date_histogram": 1544140320000,
      "host.name.terms": "blah.example.com",
      "system.process.name.terms": "proc"
    },
    "upgraded_doc_id": true
  },
  "stats": {
    "pages_processed": 49,
    "documents_processed": 396989,
    "rollups_indexed": 1320,
    "trigger_count": 24
  }
}

However the index rollup-works is empty even though the above job is clearly stating "rollups_indexed": 1320. Am I doing something wrong here?

The job itself appears sound and there are no errors I can see in the logs. Any guidance?

As an aside I am using:
Elasticsearch: 6.5.1
Kibana: 6.5.2