I figured it out. Again I apologise if im posting in the wrong section, I am new
Here is the solution :
filter {
if "Alert" in [message] {
aggregate {
task_id => "%{source}"
code => "map['alerts'] ||=' '; map['alerts'] +=%{\n}+ event.get('message')"
map_action => "create_or_update"
push_map_as_event_on_timeout => true
timeout => 120
timeout_tags => ['aggregated']
}
if "aggregated" not in [tags] {
drop{}
}
} else {
drop{}
}
}