# Aggregate filter not working

**URL:** <https://discuss.elastic.co/t/aggregate-filter-not-working/99962>\
**Category:** Logstash\
**Created:** [September 10, 2017, 6:25am UTC](https://discuss.elastic.co/t/aggregate-filter-not-working/99962 "2017-09-10T06:25:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arunvijayam](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\
**Post date:** [September 10, 2017, 6:25am UTC](https://discuss.elastic.co/t/aggregate-filter-not-working/99962/1 "2017-09-10T06:25:47Z")

</div>

Hi MagnusBaeck,

Aggregate filter not working. Seems susscessful message in trace but not working on storing output into mongodb.

My Config file as,

input {  
jdbc {  
jdbc\_connection\_string =\> "jdbc:oracle:thin:@drssqlentrac\_sc.aaa-acg.net:1521/orasliud"  
jdbc\_user =\> "admin"  
jdbc\_password =\> "admin"  
jdbc\_driver\_library =\> "C:\Official\ojdbc6-11.2.0.3.jar"  
jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver"  
statement =\> "SELECT CI.FIRST\_NAME||'_'||CI.LAST\_NAME||'_'||CI.GENDER||'\_'||TO\_CHAR(CI.DATE\_OF\_BIRTH,'YYYYMMDD') AS message, CI.TITLE AS prefix, CI.FIRST\_NAME AS firstname, CI.MIDDLE\_NAME AS middlename, CI.LAST\_NAME AS lastname, CI.TITLE\_SUFFIX AS suffix, CI.GENDER AS gender, CI.DATE\_OF\_BIRTH AS dob, CI.MARITAL\_STATUS AS maritalstatus, CI.SOCIAL\_SECURITY\_NUM AS ssn, CI.REF\_NUMBER AS clientid, NULL AS customersegmentdescription, NULL AS householdid, CASE WHEN CIP.PRIMARY\_FLAG = 'Y' THEN PHONE\_NUM END AS primaryphone, CASE WHEN CIP.NUM\_TYPE = 'Home' THEN PHONE\_NUM END AS homephone, CASE WHEN CIP.NUM\_TYPE = 'Office' THEN PHONE\_NUM END AS workphone, CIP.EXTENSION AS extension, CASE WHEN CIP.NUM\_TYPE = 'Cell' THEN PHONE\_NUM END AS mobilephone, CASE WHEN CIP.NUM\_TYPE = 'Fax' THEN PHONE\_NUM END AS faxphone, CI.EMAIL\_ADDRESS AS primaryemail, NULL AS secondaryemail, regexp\_replace(CO.ADDRESS\_LINE1,'[^a-zA-Z0-9]+','') AS address1, regexp\_replace(CO.ADDRESS\_LINE2,'[^a-zA-Z0-9]+','') AS address2, regexp\_replace(CO.ADDRESS\_LINE3,'[^a-zA-Z0-9]+','') AS address3, CO.COUNTY\_ID ||' - ' ||CO.COUNTY AS county, CO.CITY AS city, CO.STATE\_ID ||' - ' ||CO.STATE AS state, CO.ZIPCODE AS zipcode, CO.COUNTRY AS country, CPA.ADDRESS\_TYPE AS addresstype, CI.DL\_NUMBER AS licensenumber, CI.DL\_STATE\_ID AS licensestate, CPS.MEMBERSHIP\_NUMBER AS membershipid, NULL AS membershipflag, CPT.POLICY\_NUM\_PREFIX ||CPT.POLICY\_NUM AS policynumber, CPT.STATUS AS policystatus, NULL AS associatedrole, CPY.REF\_NUMBER AS agentid, CPY.FULL\_NAME AS agentname, NULL AS agentype, NULL AS agentcontactnumber, CPY.FULL\_NAME AS agencyname, NULL AS agentnumber FROM CO\_INSURED CI LEFT OUTER JOIN CO\_INSURED\_PHONE\_NUM CIP ON CI.CO\_ID = CIP.CO\_ID LEFT OUTER JOIN CO\_ADDRESS CO ON CI.CO\_ID = CO.CO\_ID LEFT OUTER JOIN CO\_PARTY\_ADDRESS CPA ON CI.CO\_ID = CPA.CO\_ID LEFT OUTER JOIN CO\_POLICY\_SNAPSHOT CPS ON CI.CO\_ID = CPS.CO\_ID LEFT OUTER JOIN CO\_POLICY\_TERM CPT ON CI.CO\_ID = CPT.CO\_ID LEFT OUTER JOIN CO\_PARTY CPY ON CI.CO\_ID = CPY.CO\_ID"  
add\_field =\> {  
"batch\_id" =\> "SPL%{+YYYYMMdd}"  
}  
}  
}  
filter {  
ruby {  
code =\> "fieldArray = event.get('firstname').to\_s.split(' ')  
a = Array.new  
fieldArray.map do |word|  
a.push(word.capitalize)  
end  
event.set('firstname',a.join(' '))"  
}

ruby {  
code =\> "fieldArray2 = event.get('lastname').to\_s.split(' ')  
b = Array.new  
fieldArray2.map do |word2|  
b.push(word2.capitalize)  
end  
event.set('lastname',b.join(' '))"  
}  
aggregate {  
task\_id =\> "%{message}"  
code =\> "  
map['message'] = event.get('message')  
map['prefix'] = event.get('prefix')  
map['firstname'] = event.get('firstname')  
map['middlename'] = event.get('middlename')  
map['prefix'] = event.get('prefix')  
map['lastname'] = event.get('lastname')  
map['suffix'] = event.get('suffix')  
map['gender'] = event.get('gender')  
map['dob'] = event.get('dob')  
map['maritalstatus'] = event.get('maritalstatus')  
map['ssn'] = event.get('ssn')  
map['clientid'] = event.get('clientid')  
map['customersegmentdescription'] = event.get('customersegmentdescription')  
map['householdid'] = event.get('householdid')  
map['primaryphone'] = event.get('primaryphone')  
map['homephone'] = event.get('homephone')  
map['workphone'] = event.get('workphone')  
map['extension'] = event.get('extension')  
map['mobilephone'] = event.get('mobilephone')  
map['faxphone'] = event.get('faxphone')  
map['primaryemail'] = event.get('primaryemail')  
map['secondaryemail'] = event.get('secondaryemail')  
map['licensenumber'] = event.get('licensenumber')  
map['licensestate'] = event.get('licensestate')  
map['membershipid'] = event.get('membershipid')  
map['membershipflag'] = event.get('membershipflag')  
map['hash\_key'] = event.get('hash\_key')  
map['address'] ||= []  
map['address'] \<\< {'address1' =\> event.get('address1'), 'address2' =\> event.get('address2'), 'address3' =\> event.get('address3'), 'county' =\> event.get('county'), 'city' =\> event.get('city'), 'state' =\> event.get('state'), 'zipcode' =\> event.get('zipcode'), 'country' =\> event.get('country') , 'addresstype' =\> event.get('addresstype') }  
map['policy'] ||= []  
map['policy'] \<\< {'policynumber' =\> event.get('policynumber'), 'policystatus' =\> event.get('policystatus'), 'associatedrole' =\> event.get('associatedrole') }  
map['agent'] ||= []  
map['agent'] \<\< {'agentid' =\> event.get('agentid'), 'agentname' =\> event.get('agentname'), 'agenttype' =\> event.get('agenttype'), 'agentcontactnumber' =\> event.get('agentcontactnumber'), 'agencyname' =\> event.get('agencyname'), 'agentnumber' =\> event.get('agentnumber') }  
event.cancel()  
"  
push\_previous\_map\_as\_event =\> true  
timeout =\> 3  
aggregate\_maps\_path =\> "C:/Official/.aggregate\_maps"

# end\_of\_task =\> true

```
   inactivity_timeout => 3
   map_action => "create_or_update"
   push_map_as_event_on_timeout => true
   timeout_code => "event.set('state', 'timeout')"
   timeout_tags => ["aggregate_timeout"]
   timeout_task_id_field => "message_failed"
 }

```

}  
output {  
mongodb {  
uri =\> "mongodb://localhost:27017/"  
database =\> "STAGING2"  
collection =\> "SPL\_STAGING2"  
isodate =\> true  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 11, 2017, 3:36am UTC](https://discuss.elastic.co/t/aggregate-filter-not-working/99962/2 "2017-09-11T03:36:23Z")

</div>

Please don't create multiple threads on the same question, it makes it harder for people to help 🙂

> [@Aggregate filter not working in logstash 5.4.2](https://discuss.elastic.co/t/aggregate-filter-not-working-in-logstash-5-4-2/99963):
>
> Hi all, Aggregate filter not working in logstash 5.4.2. I used latest aggregate filter plugin and my config file as follows. input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin:@drssqlentrac\_sc.aaa-acg.net:1521/orasliud" jdbc\_user =\> "admin" jdbc\_password =\> "admin" jdbc\_driver\_library =\> "C:\Official\ojdbc6-11.2.0.3.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" statement =\> "SELECT CI.FIRST\_NAME||'\_'||CI.LAST\_N…

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 11, 2017, 3:36am UTC](https://discuss.elastic.co/t/aggregate-filter-not-working/99962/3 "2017-09-11T03:36:27Z")

</div>