Nothing will trigger the aggregation being pushed as an event in that case. I think the minimum that will work is below. I created a file that contains
{ "INCIDENTE" : 0 }
Then I run with this configuration
input { file { path => "/home/user/foo.json" sincedb_path => "/dev/null" start_position => "beginning" } }
filter {
json { source => "message" }
aggregate {
task_id => "%{INCIDENTE}"
code => "
map['JustTesting'] ||= 0; map['JustTesting'] += 1
"
push_map_as_event_on_timeout => true
inactivity_timeout => 2
}
}
output { stdout { codec => rubydebug } }
Using a file input is important, because if you a generator the pipeline will stop executing, and there will be no thread running that can execute the timeout code. That config gets me
[2019-02-20T17:09:24,994][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
"@timestamp" => 2019-02-20T22:09:24.992Z,
"INCIDENTE" => 0,
"path" => "/home/user/foo.json",
"message" => "{ \"INCIDENTE\" : 0 }",
"@version" => "1"
}
{
"@timestamp" => 2019-02-20T22:09:30.075Z,
"JustTesting" => 1,
"@version" => "1"
}
If on the other hand I use a generator input
input { generator { count => 1 message => '{ "INCIDENTE" : 0 }' } }
Then with that same filter I get
[2019-02-20T17:14:15,587][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
"@timestamp" => 2019-02-20T22:14:15.565Z,
"sequence" => 0,
"INCIDENTE" => 0,
"message" => "{ \"INCIDENTE\" : 0 }",
"@version" => "1"
}
[2019-02-20T17:14:15,734][INFO ][logstash.pipeline ] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#<Thread:0x3765a362 run>"}
with no aggregation.