# Aggregate not working on certain events (solved) **URL:** \ **Category:** Logstash\ **Created:** [March 14, 2019, 11:03am UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319 "2019-03-14T11:03:10Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Lorenzo\_Lapotre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lorenzo_lapotre/32/41985_2.png) [@Lorenzo\_Lapotre](https://discuss.elastic.co/u/Lorenzo_Lapotre)\ **Post date:** [March 14, 2019, 11:03am UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/1 "2019-03-14T11:03:11Z")
Hello, I'm trying to aggregate multiple events that are created upon printing a document, events 842,805,307. However it seems that it is not picking up anything from 842 and 805 events. 842 and 805 carry informations like the color used when printing, username of the person who printed a documents and the number of copies that they printed. input { beats{ port =\> 5044 } } filter { ``` if [event_id] == 842 { mutate { add_field => { "Test" => "Hello" } } aggregate { task_id => "%{[user_data][JobId]}" code => "map['username'] = event.get('[user][name]')" } } if [event_id] == 805 { mutate { add_field => { "Test" => "Hello" } } aggregate { task_id => "%{[user_data][JobId]}" code => "map['color'] = event.get('[user_data][Color]') map['copies'] = event.get('Copies')" } } if [event_id] == 307 { mutate { add_field => { "Test" => "Hello" } } aggregate { task_id => "%{[user_data][Param1]}" code => "map['opcode'] = event.get('opcode')" push_map_as_event_on_timeout => true timeout => 10 } } ``` end result is : ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2695b944ed1d60c6fb7e54e49e6c606c3cca739a.png) Any help would be greatly appreciated. Thank you. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 14, 2019, 1:08pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/2 "2019-03-14T13:08:18Z")
Are you sure that [user\_data][Param1] in the last filter is equal to [user\_data][JobId] in the other filters? ---
**Author:** ![Lorenzo\_Lapotre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lorenzo_lapotre/32/41985_2.png) [@Lorenzo\_Lapotre](https://discuss.elastic.co/u/Lorenzo_Lapotre)\ **Post date:** [March 14, 2019, 1:38pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/3 "2019-03-14T13:38:38Z")
I am not sure. However both [user\_data][JobId] and [user\_data][Param1] exist. Looking at the values I assumed 'Param1' matched 'JobId'. Because event 307 doesn't have a 'JobId'. Would it be a problem if I'm mistaken and that they don't match? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 14, 2019, 1:45pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/4 "2019-03-14T13:45:49Z")
> [@Lorenzo\_Lapotre](#): > > Would it be a problem if I'm mistaken and that they don't match? Definitely. The aggregate filter groups data in "map" based on the task\_id. If the task\_id field is different then it will not connect them. ---
**Author:** ![Lorenzo\_Lapotre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lorenzo_lapotre/32/41985_2.png) [@Lorenzo\_Lapotre](https://discuss.elastic.co/u/Lorenzo_Lapotre)\ **Post date:** [March 14, 2019, 2:34pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/5 "2019-03-14T14:34:06Z")
Thanks for the help. I just checked and they do match. What else could it be? ---
**Author:** ![Lorenzo\_Lapotre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lorenzo_lapotre/32/41985_2.png) [@Lorenzo\_Lapotre](https://discuss.elastic.co/u/Lorenzo_Lapotre)\ **Post date:** [March 14, 2019, 2:41pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/6 "2019-03-14T14:41:14Z")
I put a 'push\_map\_as\_event\_on\_timeout =\> true' for every event and now I get the fields I want, but in different events instead of just one. As I said the JobId and Param1 do match... ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5ed569144beeb09d274c45cdf8b7a8a37bc9a72.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 14, 2019, 3:51pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/7 "2019-03-14T15:51:16Z")
Can you add [timeout\_task\_id\_field](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-timeout_task_id_field) to your filters? I want to make sure they do match. ---
**Author:** ![Lorenzo\_Lapotre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lorenzo_lapotre/32/41985_2.png) [@Lorenzo\_Lapotre](https://discuss.elastic.co/u/Lorenzo_Lapotre)\ **Post date:** [March 14, 2019, 4:15pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/8 "2019-03-14T16:15:49Z")
Problem is solved. Even though '[user\_data][JobId]' and '[user\_data][Param1]' did match the aggregate plugin refused to put them together so I added a new field named 'jobid' for 805 and 842 events referencing [user\_data][JobId]. Then I used task\_id =\> "%{jobid}". Thanks for your time and help, Have a great day. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 14, 2019, 4:23pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/9 "2019-03-14T16:23:01Z")
I was wondering if one was a number, like 1234, and the other was a string, like "1234". They would not match. If you used mutate to copy one field to another then it would be converted to a string if it were a number, which would cause it to start matching. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 11, 2019, 4:23pm UTC](https://discuss.elastic.co/t/aggregate-not-working-on-certain-events-solved/172319/10 "2019-04-11T16:23:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.