# Aggregate\_maps\_path file not visible

**URL:** <https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657>\
**Category:** Logstash\
**Created:** [May 1, 2020, 2:21am UTC](https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657 "2020-05-01T02:21:52Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\
**Post date:** [May 1, 2020, 2:21am UTC](https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657/1 "2020-05-01T02:21:52Z")

</div>

HI,

I have set aggregate\_maps\_path in logstash aggregate filter. However i do not see it.  
I somewhere read that logstash deletes the file and loads it into memory. Is that right ?

What i want to do is, during my deployment, take a backup of this file after stopping logstash.  
Then put the file back before starting it again.

What is the exact behavior of this file ? Where can I see the file after the logstash stops ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 1, 2020, 1:18pm UTC](https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657/2 "2020-05-01T13:18:02Z")

</div>

> [@xyz2](#):
>
> I somewhere read that logstash deletes the file and loads it into memory. Is that right ?

Yes. The code is [here](https://github.com/logstash-plugins/logstash-filter-aggregate/blob/8603b168d93c43a4bbc72ca92a633d6c5276439e/lib/logstash/filters/aggregate.rb#L137).

---

<div class="post-metadata">

**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\
**Post date:** [May 1, 2020, 2:20pm UTC](https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657/3 "2020-05-01T14:20:23Z")

</div>

thanks for confirming. Please correct me if I am wrong, If i read it right, when logstash closes, it stores the map back to the file, right ?

I executed logstash through command and stopped it. Do not see the file still !

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 1, 2020, 2:37pm UTC](https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657/4 "2020-05-01T14:37:02Z")

</div>

> [@xyz2](#):
>
> If i read it right, when logstash closes, it stores the map back to the file, right ?

Correct.

---

<div class="post-metadata">

**Author:** ![xyz2](https://avatars.discourse-cdn.com/v4/letter/x/e480ec/32.png) [@xyz2](https://discuss.elastic.co/u/xyz2)\
**Post date:** [May 4, 2020, 6:37pm UTC](https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657/5 "2020-05-04T18:37:36Z")

</div>

Is there a particular case when it gets written to file . graceful stop scenario ?  
I executed logstash through command and stopped it using ctrl + c. Do not see the file still !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2020, 6:37pm UTC](https://discuss.elastic.co/t/aggregate-maps-path-file-not-visible/230657/6 "2020-06-01T18:37:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.