# Aggregate Filter not working when aggregating Netflow data
**URL:** https://discuss.elastic.co/t/aggregate-filter-not-working-when-aggregating-netflow-data/91019
**Category:** Logstash
**Created:** [June 27, 2017, 7:27pm UTC](https://discuss.elastic.co/t/aggregate-filter-not-working-when-aggregating-netflow-data/91019 "2017-06-27T19:27:45Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Ankit\_Gupta](https://discuss.elastic.co/u/Ankit_Gupta)
#### Post date: [June 27, 2017, 7:27pm UTC](https://discuss.elastic.co/t/aggregate-filter-not-working-when-aggregating-netflow-data/91019/1 "2017-06-27T19:27:45Z")
I am getting the below data and trying to aggregate the events based on the prefix IP and add the traffic rate of all the events, but it is not working. Not sure what else I can try.
{
"netflow" =\> {
"dst\_mask" =\> 30,
"prefix" =\> "11.111.112.0",
"ipv4\_src\_addr" =\> "11.0.0.111",
"traffic\_rate" =\> 23
}
}
{
"netflow" =\> {
"dst\_mask" =\> 30,
"prefix" =\> "11.111.112.0",
"ipv4\_src\_addr" =\> "11.0.0.103",
"traffic\_rate" =\> 26
}
}
{
"netflow" =\> {
"dst\_mask" =\> 30,
"prefix" =\> "11.111.112.0",
"ipv4\_src\_addr" =\> "11.0.0.111",
"traffic\_rate" =\> 27
}
}
{
"netflow" =\> {
"dst\_mask" =\> 30,
"prefix" =\> "11.111.112.0",
"ipv4\_src\_addr" =\> "11.0.0.103",
"traffic\_rate" =\> 27
}
}
Aggregate Filter Config:
aggregate {
task\_id =\> '%{"[netflow][prefix]"}'
code =\> " map['[netflow][prefix]'] = event.get('[netflow][prefix]')
map['[netflow][rate]'] ||= 0
map['[netflow][rate]'] += event.get('[netflow][traffic\_rate]').to\_i
map['[netflow][mask]'] = event.get('[netflow][dst\_mask]')
"
push\_map\_as\_event\_on\_timeout =\> true
timeout =\> 20
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 25, 2017, 7:27pm UTC](https://discuss.elastic.co/t/aggregate-filter-not-working-when-aggregating-netflow-data/91019/2 "2017-07-25T19:27:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.