Add field for a group of events

Elastic Stack Logstash
1

For a group of events, I want to add a unique identifier. I am using aggregate plugin. The problem is that I don't want additional events from the aggregate filter and I just want to use aggregate for grouping the events but send the original ones with an additional field.

It's very similar to example 4 on the aggregate plugin page but my events are not sequential.

2

What is the grouping of the events based on?

3

Based on a field

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.