i use logstash elapsed filter to get latency between req and resp logs
logstash elapsed help me a lot. but for repeated req (same unique_id_field) logs it doesn't show correct count.
here i test elapsed config
start_tag => "app1_req"
end_tag => "app1_res"
unique_id_field => "app_id"
periodic_flush => true
timeout => 60
add_tag => ["app1"]
new_event_on_match => true
i send app1_req
8 times with
same app_id within 5 mins and i don't send app1_res.
because i want to know how may elapsed_expired_error events i get.
and i only
got 3 elapsed_expired_error events. why?
it supposes to be
because of overwirte before periodic_flush do?
does anybody plz explain to me?