I'm still having trouble understanding when logstash will timeout an aggregation when the timeout_timestamp_field is set.
If logstash has parsed the entire log file, and I don't give it any more log files, but it is still waiting on a timeout for an aggregation, what is that timeout?
I have log files that take place over the course of a single day.
The timeout value is 86400 (1 day)
The inactivity_timeout is set to 330 (5.5 minutes).
I thought all the in-memory logstash aggregations would timeout 5.5 minutes after the last event was read. But I'm still watching it push aggregation maps as events after an hour. So, what is the timeout when there are no new events to consider?