Is it possible to add aggregation directly logstash elasticsearch input plugin or use aggregation_fields filter for aggregation in logstash?

Viewed 8

Could you please assist me on how I can use logstash elasticsearch input plugin to fetch aggregate data as shown in below query ? Do I need to use aggregation_fields filter {as shown below} , post querying the data from elasticsearch input plugin? Or I can add aggregation directly under input plugin.

Thanks in advance!

 "query": {
                    "bool": {
                      "must": [
                        {
                          "match": {
                            "event.category": "authentication"
                          }
                        },
                        {
                          "match": {
                            "event.outcome": "failure"
                          }
                        }
                      ],
                      "filter": [
                        {
                          "range": {
                            "@timestamp": {
                              "gte": "now-1d"
                            }
                          }
                        }
                      ]
                    }
                  },
                  "aggs": {
                    "total_logon_per_user": {
                      "terms": {
                        "field": "user.name"
                      }
                    }
                  }
filter {
      elasticsearch {
        aggregation_fields => {
          "total_logon_per_user" => "user.name"
        }
      }
    }
0 Answers
Related