Aggregate and elapsed filter plugins - multiple events processing

Elastic Stack Logstash
1

Why there is a limitation in aggregate plugin usage:
"You should be very careful to set logstash filter workers to 1 (-w 1 flag) for this filter to work correctly otherwise events may be processed out of sequence and unexpected results will occur".

But another filter plugin elapsed which works with multiple events too does not have such a limitation?

It seems that "out of sequence processing" effect is more important in duration calculation but not in aggregation.

2

i believe elapsed filter, too, has such limitation. If processed out of sequence, elapsed filter will throw an error for an event with no beginning.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.