Aggregate plugin + event.get('@timestamp')

Elastic Stack Logstash
1

Hello there,
I must be doing it wrong :slightly_smiling_face:

   aggregate {
        task_id => "%{clientip}"
        code => "map['timestamp'] ||= event.get['@timestamp'].to_i"
        push_map_as_event_on_timeout => true
        timeout_task_id_field => "clientip"
        timeout => 14400
        inactivity_timeout => 600
        timeout_tags => ['_aggregatetimeout']
        timeout_code => "event.set('session_duration', map['timestamp'] - event.get['@timestamp'].to_i)"
    }

Throws me a:

[ERROR][logstash.filters.aggregate] Aggregate exception occurred {:error=>#<ArgumentError: wrong number of arguments calling `get` (0 for 1)>, :code=>"map['timestamp'] ||= event.get['@timestamp'].to_i", :map=>{}

Can't find out what's wrong. The idea being to catch the timestamp from first event and compute difference with last event.

BTW, Logstash 5.5.0
Thanks for any help!

2

It's event.get(...), not event.get[...].

3

Oh god.
Thanks Magnus.

4

Hi Magnus,

which kind of code is this? Is there a syntax description for it somewhere?

Thanks,
regards,
Jonas

5

which kind of code is this?

Ruby.

Is there a syntax description for it somewhere?

The Ruby language is of course well known and the Logstash event API is described at Event API | Logstash Reference [8.11] | Elastic.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.