X-pack not generating indices

[Sjaak01 (Sjaak)]

@bohyun

To view the raw objects in your .reporting index, run GET .reporting-2017.06.11/_search and you will be able to see all of the reports that were generated from 2017.06.11 to today.

Thanks.

Something like this but because I don't know what I'm doing its not really going anywhere at the moment.

Alert on SUM of field exeeding certain value?

Hey, this sounds possible to me. The important part here is to write a proper search query (independent from the watch). The search query needs to do the following have a range filter in your query that filters from the first of the month until now have a term filter in your query (or a match query), that filters for the host you are interested in have a sum aggregation in your request, that counts up your bytes (use the sum aggregation Now you got the correct data (a single aggregation re…