Hi!
I've got a couple of question about this plugin.
I need to link a value from event A to an elapsed value from event B which does not depend on timestamp. I also want to retry in a second time if one of the two events is missing. Could you please tell me if this is the most suitable plugin for this use case?
I'm able to do the first part, but non the second retry.
Is there a way to add a tag to a start event if no end events occur? I would like to query elastic search a second time for those events and find out if any end events was indexed.
How do timeout events work? Is a new event created? I tried many options, like timeout_tags and timeout, but I was never able to get a timeout event (I've tried to send in both a start event without end and an end event without start).
This is my last config:
if "aggregate_required" in [tags]{
if "aggregate_start" in [tags]{
aggregate {
task_id => "%{transaction_id}"
code => "map['duration'] = event['activity_duration']"
map_action => "create"
remove_tag => ["aggregate_required"]
add_tag => ["aggregate_done"]
}
}
else if "aggregate_end" in [tags] {
aggregate {
task_id => "%{transaction_id}"
code => "event['activation_elapsed'] = map['duration']"
map_action => "update"
end_of_task => true
remove_tag => ["aggregate_required"]
add_tag => ["aggregate_done"]
timeout_tags => ["aggregate_required]
timeout => 10
}
}
}
With this config I can parse a start event only one time ("aggregate_required" is always removed). End events without start are left untouched, so I can try to aggregate them a second time ("aggregate_required" is not removed). I would like to add again "aggregate_required" to a start event.
Thank you!