2

I have program send logs by rsyslog to graylog and save them in elastic search. I used elastic search 1.7.

message send by rsyslog like this

{"t" : [
{"id":10,"x":12,"y":15,"z":8},
{"id":12,"x":8,"y":6,"z":1},
{"id":10,"x":2,"y":1,"z":6}
]}

I want get sum of x, y, z for all message that have same id. what query I use?

I used this query but not work correct.

{
  "aggs" : {
    "t" : {
       "nested" : {
          "path" : "t"
       },
       "aggs" : {   
           "sum_x" : { "sum" : { "field" : "t.x" } }
      }
    }
   }
}
sharafi
  • 531
  • 1
  • 7
  • 19

0 Answers0