# Aggregate events with START but no END
**URL:** https://discuss.elastic.co/t/aggregate-events-with-start-but-no-end/75208
**Category:** Logstash
**Created:** [February 15, 2017, 2:09pm UTC](https://discuss.elastic.co/t/aggregate-events-with-start-but-no-end/75208 "2017-02-15T14:09:42Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@frontman](https://discuss.elastic.co/u/frontman)
#### Post date: [February 15, 2017, 2:09pm UTC](https://discuss.elastic.co/t/aggregate-events-with-start-but-no-end/75208/1 "2017-02-15T14:09:42Z")
Hi all,
I'm new to the ELK family and currently encountering a problem.
I'm using the logstash-filter-aggregate to aggregate events that have a clear START event (second field containing 70), but no END event.
The task\_id can be the same throught the file.
The problem is that if I use the timeout variable to flush the map, it may be possible that a new START event arrives before the end of the timeout and so that event is lost.
Here's an example of the log file
task\_id,var1,var2
id1,a70,aaa
id1,a30,bbb
id1,x70,ccc
id1,b40,ddd
and the config
if [var1] =~ "70" {
aggregate {
task\_id =\> "%{task\_id}"
code =\> "
map['var2'] = event.get('var2')
"
map\_action =\> "create"
}
} else {
aggregate {
task\_id =\> "%{task\_id}"
code =\> "
map['var2'] \<\< event.get('var2')
"
push\_map\_as\_event\_on\_timeout =\> true
timeout =\> 60
}
}
So for the previous events I should have 2 events
Any help will be appreciated.
thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 15, 2017, 2:09pm UTC](https://discuss.elastic.co/t/aggregate-events-with-start-but-no-end/75208/2 "2017-03-15T14:09:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.