# Aggregate filter: How to delete the event when no matching task\_id found within the timeout?

**URL:** https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375
**Category:** Logstash
**Created:** [June 9, 2021, 6:05am UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375 "2021-06-09T06:05:50Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![subash](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/subash/32/59912_2.png) [@subash](https://discuss.elastic.co/u/subash)
#### Post date: [June 9, 2021, 6:05am UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375/1 "2021-06-09T06:05:51Z")

</div>

Hi,

I am using aggregate filter in Logstash to merge the events based on **task\_id**. The problem is, I don't want to push the event when no matching **task\_id** found within the given timeout.

Please pour you ideas to achieve it.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2021, 3:59pm UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375/2 "2021-06-09T15:59:30Z")

</div>

What does your aggregate configuration look like?

---

<div class="post-metadata">

### Author: ![subash](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/subash/32/59912_2.png) [@subash](https://discuss.elastic.co/u/subash)
#### Post date: [June 10, 2021, 4:58am UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375/3 "2021-06-10T04:58:05Z")

</div>

```auto
aggregate {
   task_id => "%{[kvData][flowId]}"
        code => '
            map["kvData"] ||= {}
            map["kvData"] = map["kvData"].merge(event.get("kvData"))
            map["Type"] = event.get("Type")
            map["Timestamp"] = event.get("timestamp")
                        map["@timestamp"] = event.get("@timestamp")
            event.cancel
        '
         push_map_as_event_on_timeout => true
         timeout_timestamp_field => "@timestamp"
         inactivity_timeout => 10
         timeout => 10
         timeout_tags => ['_aggregatetimeout']
         timeout_task_id_field => "[kvData][flowId]"
}

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 10, 2021, 4:39pm UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375/4 "2021-06-10T16:39:09Z")

</div>

It sounds like you want to `drop {}` the event if there have not been multiple events combined. If so you could add

```
 map["eventCount"] ||= 0
 map["eventCount"] += 1

```

to the code option, and then

```
if [eventCount] == 1 {
    drop {}
else {
    mutate { remove_field => ["eventCount"] }
}

```

If I have misunderstood your question please explain further.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 8, 2021, 4:39pm UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375/5 "2021-07-08T16:39:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.