Hi all,
i'm trying to use aggregation filter, i have a big result set (more than 140k rows from mySql).
And the aggregation stopped always at row 53.
In the log I can see this error:
[ERROR][logstash.javapipeline ][main] Pipeline error {:pipeline_id=>"main", :exception=>#<LogStash::ConfigurationError: Aggregate plugin: For task_id pattern '%{id}', there are more than one filter which defines timeout options. All timeout options have to be defined in only one aggregate filter per task_id pattern. Timeout options are : timeout, inactivity_timeout, timeout_code, push_map_as_event_on_timeout, push_previous_map_as_event, timeout_timestamp_field, timeout_task_id_field, timeout_
the aggregation filter is the following (I ommitted many rows):
filter {
aggregate {
task_id => "%{id}"
code => "
map['id'] = event.get('id')
map['tas'] = event.get('tas')
...
...
...
map['dati_sospensione'] ||= []
map['dati_sospensione'] << { 'stato_sospensione_id' => event.get('stato_sospensione_id'), 'data_fine_sospensione' => event.get('data_fine_sospensione'),
'data_fine_sospensione' => event.get('data_fine_sospensione'), 'sospensione_stato_attiva' => event.get('sospensione_stato_attiva'),
'stato_sospensione_user_ins' => event.get('stato_sospensione_user_ins'), 'stato_sospensione_data_ins' => event.get('stato_sospensione_data_ins'),
'stato_sospensioni_user_mod' => event.get('stato_sospensioni_user_mod'), 'stato_sospensioni_data_mod' => event.get('stato_sospensioni_data_mod')}
event.cancel()
"
timeout_task_id_field => "id"
timeout => 10
push_previous_map_as_event => true
}
}
Maybe the problem is on the mapping?!
A hug and a kiss to anyone can help me, i'm going crazy.
KR
Roberto