Aggregate filter check value with all previous records

Elastic Stack Logstash
1

while reading the csv file in logstash i want to compare value with all the previous record and depending on the condition set a field with true or false.
m able to compare with the immediate previous record but i want check for all the previous record.
Is it possible to do using aggregate filter ?

here's my current aggregate filter

 aggregate {
	task_id => "%{odr}"
	code => "
	map['dur'] ||= event.get('endtime');
	event.set('isCc', (event.get('starttime') < map['dur'])?1:0);
	map['dur'] = event.get('endtime');
	"
	push_map_as_event_on_timeout => true
	timeout_task_id_field => "odr"
	timeout => 30
	timeout_tags => ['_aggregatetimeout']
	timeout_code => ""
}

Thanks

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.