Aggregate plugin + event.get('@timestamp')

Hello there,
I must be doing it wrong :slightly_smiling_face:

   aggregate {
        task_id => "%{clientip}"
        code => "map['timestamp'] ||= event.get['@timestamp'].to_i"
        push_map_as_event_on_timeout => true
        timeout_task_id_field => "clientip"
        timeout => 14400
        inactivity_timeout => 600
        timeout_tags => ['_aggregatetimeout']
        timeout_code => "event.set('session_duration', map['timestamp'] - event.get['@timestamp'].to_i)"
    }

Throws me a:

[ERROR][logstash.filters.aggregate] Aggregate exception occurred {:error=>#<ArgumentError: wrong number of arguments calling `get` (0 for 1)>, :code=>"map['timestamp'] ||= event.get['@timestamp'].to_i", :map=>{}         

Can't find out what's wrong. The idea being to catch the timestamp from first event and compute difference with last event.

BTW, Logstash 5.5.0
Thanks for any help!

It's event.get(...), not event.get[...].

Oh god.
Thanks Magnus.

Hi Magnus,

which kind of code is this? Is there a syntax description for it somewhere?

Thanks,
regards,
Jonas

which kind of code is this?

Ruby.

Is there a syntax description for it somewhere?

The Ruby language is of course well known and the Logstash event API is described at Event API | Logstash Reference [8.11] | Elastic.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.