# Significant terms and logstash **URL:** \ **Category:** Elasticsearch\ **Created:** [May 15, 2014, 6:36am UTC](https://discuss.elastic.co/t/significant-terms-and-logstash/17528 "2014-05-15T06:36:48Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Klavs\_Klavsen](https://avatars.discourse-cdn.com/v4/letter/k/90db22/32.png) [@Klavs\_Klavsen](https://discuss.elastic.co/u/Klavs_Klavsen)\ **Post date:** [May 15, 2014, 6:36am UTC](https://discuss.elastic.co/t/significant-terms-and-logstash/17528/1 "2014-05-15T06:36:48Z")
Hi guys, I am looking into using the significant terms aggregation with our logstash data, but my reading of it has given me one issue which I hope you have ideas for solving. As I understand it - ES 1.1.1 only supports using 1 index (entire index) as the "background data" to identify what stands out in the search'ed set. Problem with logstash - is that it per default creates a new index every day (which I like for a lot of other purposes), but if a significant terms aggregation on logs should make sense - it would be more relevant to be able to use a month or so, as the "background data". Anyone know if I can somehow pursuade it, into using more than just 1 index as "background data" ? Or would I have to have a copy of 1 months data or so - put into a "background index" - to do this? ☹ -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/af955818-9a40-44c1-90fb-e074cc1983bb%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/af955818-9a40-44c1-90fb-e074cc1983bb%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![loren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loren/32/44942_2.png) [@loren](https://discuss.elastic.co/u/loren)\ **Post date:** [May 23, 2014, 11:52pm UTC](https://discuss.elastic.co/t/significant-terms-and-logstash/17528/2 "2014-05-23T23:52:14Z")
I just tried this out with 1.2.0 and got the same result. Even if I specify logstash-\*, it only seems to take today's index into account. However, the documentation[http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-aggregations-bucket-significantterms-aggregation.html#\_single\_set\_analysis](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-aggregations-bucket-significantterms-aggregation.html#_single_set_analysis)states that "the background set used for statistical comparisons is the index or _indices_ from which the results were gathered". So it seems like it ought to work as you and I are hoping, but perhaps someone else has more info. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/22c7c4b6-0665-4286-8a0c-0c9decf67795%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/22c7c4b6-0665-4286-8a0c-0c9decf67795%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:27am UTC](https://discuss.elastic.co/t/significant-terms-and-logstash/17528/3 "2017-07-06T01:27:16Z")