Something like this should get you started.
input { generator { count => 1 lines => [ 'a1', 'b1', 'a2', 'b2' ] } }
filter {
if [message] =~ /^a/ {
#start
mutate { add_tag => ["sessionStart"] }
fingerprint { target => "uuid" }
ruby { code => '@@uuid = event.get("uuid")' }
} else {
#end
mutate { add_tag => ["sessionEnd"] }
ruby { code => 'event.set("uuid", @@uuid)' }
}
}
output { stdout { } }