# Aggregate Plugin push\_previous\_map\_as\_event **URL:** \ **Category:** Logstash\ **Created:** [October 15, 2019, 6:01pm UTC](https://discuss.elastic.co/t/aggregate-plugin-push-previous-map-as-event/203701 "2019-10-15T18:01:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Guanda\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guanda_li/32/47827_2.png) [@Guanda\_Li](https://discuss.elastic.co/u/Guanda_Li)\ **Post date:** [October 15, 2019, 6:01pm UTC](https://discuss.elastic.co/t/aggregate-plugin-push-previous-map-as-event/203701/1 "2019-10-15T18:01:23Z")
I'm aggregating streaming connection log from nginx server. Usually there are several similar events coming with same id, then there are another bunch of similar events with another id coming. I'm trying to get the number of consecutive events with same id. The problem is that there is no start and end event in my case, every time I see a new id it should be the end of previous map. I used push\_previous\_map\_as\_event and it works fine, but it keeps the previous map alive and never end it. Is there any way I can set end\_of\_task =\> true after push\_previous\_map\_as\_event is true? Thank you! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 15, 2019, 6:31pm UTC](https://discuss.elastic.co/t/aggregate-plugin-push-previous-map-as-event/203701/2 "2019-10-15T18:31:55Z")
You could switch to push\_map\_as\_event\_on\_timeout with a short timeout. ---
**Author:** ![Guanda\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guanda_li/32/47827_2.png) [@Guanda\_Li](https://discuss.elastic.co/u/Guanda_Li)\ **Post date:** [October 15, 2019, 6:42pm UTC](https://discuss.elastic.co/t/aggregate-plugin-push-previous-map-as-event/203701/3 "2019-10-15T18:42:46Z")
I just tried it out, but push\_map\_as\_event\_on\_timeout also keeps the previous map alive. For example, I have 10 events with id 1 coming, and then I have 10 events with id 2 coming. Then I see 10 events with id 1 again. What I want is: id: 1 counter: 10 id: 2 counter: 10 id: 1 counter: 10 But what happened is: id: 1 counter: 10 id: 2 counter: 10 id: 1 counter: 20 id: 2 counter: 10 So it not only keeps the previous map alive but also push all of them out after I had a new aggregation task coming. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 15, 2019, 7:23pm UTC](https://discuss.elastic.co/t/aggregate-plugin-push-previous-map-as-event/203701/4 "2019-10-15T19:23:36Z")
Try ``` push_map_as_event_on_timeout => true push_previous_map_as_event => true timeout => 0 ``` ---
**Author:** ![Guanda\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guanda_li/32/47827_2.png) [@Guanda\_Li](https://discuss.elastic.co/u/Guanda_Li)\ **Post date:** [October 16, 2019, 1:18am UTC](https://discuss.elastic.co/t/aggregate-plugin-push-previous-map-as-event/203701/5 "2019-10-16T01:18:28Z")
Thank you for your help! Actually push\_map\_as\_event\_on\_timeout works good. The reason I don't see it working correct is because I am manually pasting some log as input. And maybe that's not really a streaming. I just verified the number using real streaming data and it looks good. Thank you for your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 13, 2019, 1:18am UTC](https://discuss.elastic.co/t/aggregate-plugin-push-previous-map-as-event/203701/6 "2019-11-13T01:18:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.