# Aggregate filter plugin not working

**URL:** https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374
**Category:** Logstash
**Created:** [July 24, 2018, 11:58am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374 "2018-07-24T11:58:58Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Avinash\_Kumar](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@Avinash\_Kumar](https://discuss.elastic.co/u/Avinash_Kumar)
#### Post date: [July 24, 2018, 11:58am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374/1 "2018-07-24T11:58:59Z")

</div>

i copied the exact same example on the documentation page:  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example1](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example1)

with the filter and made the setup in logstash , but it is not working?  
any idea what to do?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 24, 2018, 12:06pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374/2 "2018-07-24T12:06:31Z")

</div>

What do you mean by "it is not working"? What is the configuration and what is the result?

---

<div class="post-metadata">

### Author: ![Avinash\_Kumar](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@Avinash\_Kumar](https://discuss.elastic.co/u/Avinash_Kumar)
#### Post date: [July 24, 2018, 12:20pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374/3 "2018-07-24T12:20:28Z")

</div>

logs:

INFO - 12345 - TASK\_START - start  
INFO - 12345 - SQL - sqlQuery1 - 12  
INFO - 12345 - SQL - sqlQuery2 - 34  
INFO - 12345 - TASK\_END - end

logstash config:

input {  
beats {  
port =\> "5044"  
}  
}  
filter {  
grok {  
match =\> ["message", "%{LOGLEVEL:loglevel} - %{NOTSPACE:user\_id} - %{GREEDYDATA:msg\_text}"]  
add\_tag =\> ["grok done"]  
}

aggregate {  
task\_id =\> "%{user\_id}"  
code =\> "map['clicks'] ||= 0; map['clicks'] += 1;"  
push\_map\_as\_event\_on\_timeout =\> true  
timeout\_task\_id\_field =\> "user\_id"  
timeout =\> 600 # 10 minutes timeout  
timeout\_tags =\> ['\_aggregatetimeout']  
timeout\_code =\> "event.set('several\_clicks', event.get('clicks') \> 1)"  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "merge004"  
}  
}

output:

 ![asdasda](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a67bccc26682cf15987bc344e8476c3e33803131.png)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 24, 2018, 2:00pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374/4 "2018-07-24T14:00:39Z")

</div>

The events in Kibana have a taskid. The logstash configuration would produce user\_id. So that is not the output of that configuration. Also, your data has both start and end markers, so why use the configuration for data that does not?

Also, are you using --pipeline.workers 1 or -w 1?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 21, 2018, 2:05pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-not-working/141374/5 "2018-08-21T14:05:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.