field

This setting is available in the age filtertype, and any filter which has the use_age setting. This setting is strictly optional.

 - filtertype: age
   source: field_stats
   direction: older
   unit: days
   unit_count: 3
   field: '@timestamp'
   stats_result: min_value

The value of this setting must be a timestamp field name. This field must be present in the indices being filtered or an exception will be raised, and execution will halt.

field_stats uses the Field Stats API to calculate either the min_value or the max_value of the field as the stats_result, and then use that value for age comparisons.

This setting is only used when source is field_stats.

The default value for this setting is @timestamp.

« exclude intersect »