Could you please assist me on how I can use logstash elasticsearch input plugin to fetch aggregate data as shown in below query ? Do I need to use aggregation_fields filter {as shown below} , post querying the data from elasticsearch input plugin? Or I can add aggregation directly under input plugin.
Thanks in advance!
"query": {
"bool": {
"must": [
{
"match": {
"event.category": "authentication"
}
},
{
"match": {
"event.outcome": "failure"
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-1d"
}
}
}
]
}
},
"aggs": {
"total_logon_per_user": {
"terms": {
"field": "user.name"
}
}
}
filter {
elasticsearch {
aggregation_fields => {
"total_logon_per_user" => "user.name"
}
}
}