note: this question is obviously similar to this post, but it was closed without any replies.
When I want to create an index pattern on a rollup job I get the message "Rollup index pattern error: Multiple date histograms configured". This seems weird, in the config (pasted below) I only see 1 date_histogram, on the @timestamp field with 24h intervals and I created this config with the rollup job wizard. Is this a bug or am I doing something wrong? My goal is to make nice graphs of the actions that our users perform, so how do I solve this problem so that I can make the an index pattern (which is required to make visualizations).
We're on Elastic Search/Kibana version 6.6.1 by the way (cloud hosted)
I grabbed the following from the rollup job's JSON tab (on the Management -> Elasticsearch -> Rollup Jobs page). The values are slightly redacted so as not to accidentally leak personally identifiable or company data.
{
"config": {
"id": "Appname daily rollup",
"index_pattern": "appname-*",
"rollup_index": "rollup-daily-appname",
"cron": "0 0 2 * * ?",
"groups": {
"date_histogram": {
"interval": "24h",
"field": "@timestamp",
"time_zone": "UTC"
},
"terms": {
"fields": [
"zone.keyword",
"level.keyword",
"context.keyword",
"account.keyword",
"user.keyword",
"action.keyword"
]
}
},
"metrics": [],
"timeout": "20s",
"page_size": 1000
},
"status": {
"job_state": "started",
"current_position": {
"@timestamp.date_histogram": 1554681600000,
"account.keyword.terms": "some account name",
"action.keyword.terms": "process",
"context.keyword.terms": "some context",
"level.keyword.terms": "prod",
"user.keyword.terms": "some user name",
"zone.keyword.terms": "some geographical zone"
},
"upgraded_doc_id": true
},
"stats": {
"pages_processed": some int,
"documents_processed": some int,
"rollups_indexed": some int,
"trigger_count": 4,
"index_time_in_ms": some int,
"index_total": some int,
"index_failures": 0,
"search_time_in_ms": some int,
"search_total": some int,
"search_failures": 0
}
}