Aggregations - Alerting Plugin

[Ana Coelho]

I want to know how I can put the full log from the event in aggregation, because the full log is not a field. I know how I can put, for example, the agent. name, but full log, I don't know.

Example: 

"aggregations": {

   "agent.name": {

     "terms": {

         "field": "agent.name",

     .....