I'm new to rollup jobs and I wanted to ask your opinion on some of the issues I'm encountering.
Question One: How to handle different data types such as IP
Here's my way of seeing it: Rollup jobs have to main components: the Metrics Fields which contain everything that can be condensed and manipulated basically floats and longs. And the Terms Fields which is everything else but only Keyword and Text. How does one handle stuff like IP or GEO IP Data types? Do some sort of conversion internally and save a duplicate as a string to be able to roll it up later on?
Sometimes I get the error message: "must be aggregatable across all indices, but is not" how can this happen? Can it have something to do with my ILM policy? I do an index rollover when I reach a certain size. This leads me to the question, do you guys have any special tips on how to combine this with index rollovers? Is pointing the index_pattern to the index alias name a good way to go about this.
With kind Regards