# Aggregate filter plugin throwing undefined method error

**URL:** <https://discuss.elastic.co/t/aggregate-filter-plugin-throwing-undefined-method-error/136027>\
**Category:** Logstash\
**Created:** [June 15, 2018, 3:59am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-throwing-undefined-method-error/136027 "2018-06-15T03:59:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticuser1](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)\
**Post date:** [June 15, 2018, 3:59am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-throwing-undefined-method-error/136027/1 "2018-06-15T03:59:38Z")

</div>

Hi,

I am trying to get the difference between startDt and endDt but I am getting the below error -

Aggregate exception occurred {:error=\>#\<NoMethodError: undefined method `-' for "2018-06-15T03:50:26.109":String

Both startDt and endDt are date types. Here is my logstash code:

```
 if [ivrCall][startDt] {
      aggregate {
       task_id => "%{[ivrCall][callId]}"
       code => "map['call_duration'] = event.get('[ivrCall][startDt]')"
       map_action => "create"
     }
     }
     if [ivrCall][endDt] {
      aggregate {
       task_id => "%{[ivrCall][callId]}"
       code => "map['call_duration'] = event.get('[ivrCall][endDt]') - map['call_duration']; event.set('call_duration', map['call_duration'])"
       map_action => "update"
       end_of_task => true
       timeout => 120
     }
     }

```

I have no idea what is wrong. I tried multiple times by changing the code. Why it's not recognizing - ? Please suggest. Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 15, 2018, 2:15pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-throwing-undefined-method-error/136027/2 "2018-06-15T14:15:45Z")

</div>

> [@elasticuser1](#):
>
> Both startDt and endDt are date types.

I think it is telling you right there in the error message that at least one of them is a "String". You may have to convert them using DateTime.strptime.

---

<div class="post-metadata">

**Author:** ![elasticuser1](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)\
**Post date:** [June 15, 2018, 5:18pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-throwing-undefined-method-error/136027/3 "2018-06-15T17:18:19Z")

</div>

Thanks @Badger. If I do like this, below error I am getting -

[2018-06-15T17:11:38,753][ERROR][logstash.filters.aggregate] Aggregate exception occurred {:error=\>#\<TypeError: no implicit conversion to rational from string\>, :code=\>"map['duration'] = event.get('endt') - map['stdt']; event.set('call\_duration', map['duration'])", :map=\>{"stdt"=\>"2018-06-15T17:11:30.508"},

```
if [ivrCall][startDt] {
      aggregate {
       task_id => "%{[ivrCall][callId]}"
       code => "map['stdt'] = event.get('[ivrCall][startDt]')"
       map_action => "create"
     }
     }
      date {
        match => ["stdt", "yyyy-MM-dd'T'HH:mm:ss.SSS"]
        target => "stdt"
      }
     if [ivrCall][endDt] {
      date {
        match => ["[ivrCall][endDt]", "yyyy-MM-dd'T'HH:mm:ss.SSS" ]
        target => "endt"
      }
      aggregate {
       task_id => "%{[ivrCall][callId]}"
       code => "map['duration'] = event.get('endt') - map['stdt']; event.set('call_duration', map['duration'])"
       map_action => "update"
       end_of_task => true
       timeout => 120
     }
     }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 15, 2018, 6:07pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-throwing-undefined-method-error/136027/4 "2018-06-15T18:07:46Z")

</div>

The delta between two DateTime objects is a Rational (a fraction of a day such as 380287/43200000) and you cannot do an implicit to\_s on it.

What I was thinking was some ruby more like this. I will let you fit it into the aggregate filter.

```
output { stdout { codec => rubydebug } }
input { generator { count => 1 message => '' } }
filter {
    mutate { add_field => { "[ivrCall][startDt]" => "2018-06-15T17:11:30.508" "[ivrCall][endDt]" => "2018-06-15T17:24:11.082" } }
    ruby {
        code => "
            event.set('duration', 86400 * (DateTime.strptime(event.get('[ivrCall][endDt]'), '%Y-%m-%dT%H:%M:%S.%L') -
                                  DateTime.strptime(event.get('[ivrCall][startDt]'), '%Y-%m-%dT%H:%M:%S.%L')).to_f)
        "
    }
}

```

Running that I get

```
      "duration" => 760.5740000000001
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2018, 6:07pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-throwing-undefined-method-error/136027/5 "2018-07-13T18:07:46Z")

</div>

Closed on July 13, 2018, 6:07pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.