Kibana 7.7.1
I am creating a transform to do an aggregation on a true/false field per user's set of data.
on the source index document can be updated with updated status (true/false) and also new data are coming. Source index frequency of change can be more than 1 hour.
I am creating Transform sync on @timestamp
I created as many transforms as i can with all frequency and sync/delay possibilities and it never updated after creation and has only one checkpoint of creation.
I am not sure what am I doing wrong here is the transform API I used
PUT _transform/mytransform
{
"source": {
"index": [
"mysource"
],
"query": {
"bool": {
"must": [
{
"match_all": {}
}
],
"filter": [
{
"match_phrase": {
"myflag": false
}
},
{
"range": {
"mydate": {
"lt": "now"
}
}
}
],
"should": [],
"must_not": []
}
}
},
"dest": {
"index": "mydest"
},
"frequency": "1h",
"sync": {
"time": {
"field": "@timestamp",
"delay": "24h"
}
},
"pivot": {
"group_by": {
"userID.keyword": {
"terms": {
"field": "userID.keyword"
}
}
},
"aggregations": {
"userDocID.keyword.value_count": {
"value_count": {
"field": "userDocID.keyword"
}
}
}
}
}