# Another Aggregate filter issue

**URL:** <https://discuss.elastic.co/t/another-aggregate-filter-issue/145462>\
**Category:** Logstash\
**Created:** [August 21, 2018, 9:51pm UTC](https://discuss.elastic.co/t/another-aggregate-filter-issue/145462 "2018-08-21T21:51:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ITNinjaGirl](https://avatars.discourse-cdn.com/v4/letter/i/e56c9b/32.png) [@ITNinjaGirl](https://discuss.elastic.co/u/ITNinjaGirl)\
**Post date:** [August 21, 2018, 9:51pm UTC](https://discuss.elastic.co/t/another-aggregate-filter-issue/145462/1 "2018-08-21T21:51:06Z")

</div>

Hi. I am new to using the Aggregate filter. What I have is rsyslog data coming from an ntopng system. I need to aggregate when a network device disconnects and then reconnects to determine the duration of the disconnect.

This is what I have.  
if [DeviceStatus] == "disconnected" {  
aggregate {  
task\_id =\> "%{macadd}"  
code =\> "map['NewTimestamp'] = 0"  
map\_action =\> "create"  
}  
}

```
    if [DeviceStatus] == "connected" {
      aggregate {
        task_id => "%{macadd}"
        code => "map['NewTimestamp'] += event.get{'duration'}"
        map_action => "update"
        end_of_task => true
        timeout => 120
     }
    }
```

---

<div class="post-metadata">

**Author:** ![ITNinjaGirl](https://avatars.discourse-cdn.com/v4/letter/i/e56c9b/32.png) [@ITNinjaGirl](https://discuss.elastic.co/u/ITNinjaGirl)\
**Post date:** [August 23, 2018, 12:23pm UTC](https://discuss.elastic.co/t/another-aggregate-filter-issue/145462/2 "2018-08-23T12:23:25Z")

</div>

Aug 19 22:37:00 ntopng-eq ntopng: [Alert] The device href="/lua/mac\_details.lua?host=00:0C:29:20:38:BC"\>[OnclaveOSSIM.onclave.net](http://OnclaveOSSIM.onclave.net) has disconnected from the network.

this is the syslog message that I am trying to use as the start of a task. The mac address has a potential to be one of 1000+ devices. I am trying to calculate duration between a device disconnecting and when it reconnects (if at all).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2018, 12:23pm UTC](https://discuss.elastic.co/t/another-aggregate-filter-issue/145462/3 "2018-09-20T12:23:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.