Aggregate

Elastic Stack Logstash
1 
aggregate{
    		task_id => "%{Response}"
         	code =>"
                    if(event.get(Response) == "answered")
         		       map['answers'] ||= 0;
    			       map['answers'] += 1;
                    end
        	"
        	push_map_as_event_on_timeout => true
        	timeout_task_id_field => "callMessage"
        	timeout => 60
        	timeout_tags => ['_aggregatetimeout']
			timeout_code => "event.set('several_incomings', event.get('answers') > 1)"

    	}

When I use this in my logstash configuration file, I get this error message:

[ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, }

I don't understand what's wrong. When I remove the if statement, it works, but I only want to count the "answered" calls.

2

There's a double quoted string in your condition and your code is wrapped in double quotes as well. That's why the parser thinks your code ends after == " and everything else is nonsense. Try

== 'answered')

instead

1 Like
3

Thank you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.