Elapsed_expired_error event is not generated for same repeated logs

Elastic Stack Logstash
1

hi there

i use logstash elapsed filter to get latency between req and resp logs
logstash elapsed help me a lot. but for repeated req (same unique_id_field) logs it doesn't show correct count.

here i test elapsed config

elapsed {
start_tag => "app1_req"
end_tag => "app1_res"
unique_id_field => "app_id"
periodic_flush => true
timeout => 60
add_tag => ["app1"]
new_event_on_match => true
}

i send app1_req 8 times with same app_id within 5 mins and i don't send app1_res.
because i want to know how may elapsed_expired_error events i get.
and i only got 3 elapsed_expired_error events. why?
it supposes to be 8 right?
because of overwirte before periodic_flush do?

does anybody plz explain to me?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.