# Would someone please paste a verbose sample of filter metrics?

**URL:** <https://discuss.elastic.co/t/would-someone-please-paste-a-verbose-sample-of-filter-metrics/51508>\
**Category:** Logstash\
**Created:** [June 1, 2016, 3:33am UTC](https://discuss.elastic.co/t/would-someone-please-paste-a-verbose-sample-of-filter-metrics/51508 "2016-06-01T03:33:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)\
**Post date:** [June 1, 2016, 3:33am UTC](https://discuss.elastic.co/t/would-someone-please-paste-a-verbose-sample-of-filter-metrics/51508/1 "2016-06-01T03:33:49Z")

</div>

I'm analyzing nginx logs with ELK.

For the logs were too large (10GB per day), I don't want to save all the detail data into es, but only the aggregations.And I found `metrics` filter is suitable for my occasion.

What I wanna record was the counts of different groups for every ten minutes.

- counts of groups (ip, user-agent)
- counts of groups (ip, session\_id, platform)
- and so on

However, the document of `metric` filter is too simple for me to understand.  
This is the config file I've written, it seemed not work.

```auto
input {
    file {
        path => "/path/to/access.log"
    }
}

filter {
    some_filter { 
        # grok,geoip,useragent to parse log
    }
    metrics { 
        add_field => { 
            "session_id" => "%{id}" 
            "time" => "%{t}" 
            "landing_page" => "%{lh}"
            "period" => "%{p}" 
            "platform" => "%{pf}" 
        } 
        timer => ["aggs", "%{id} %{t} %{lh} %{p} %{pf}"]
        add_tag => "me"
    }
}

output {
    if "me" in [tags] {
    elasticsearch {
        index => "user_record"
        document_type => "tjj_access"
        hosts => ["10.10.20.143:9200"]
    }
    #stdout { codec => json }
    }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/would-someone-please-paste-a-verbose-sample-of-filter-metrics/51508/2 "2017-07-06T04:55:07Z")

</div>