# Elapsed\_expired\_error event is not generated for same repeated logs

**URL:** https://discuss.elastic.co/t/elapsed-expired-error-event-is-not-generated-for-same-repeated-logs/160316
**Category:** Logstash
**Created:** [December 11, 2018, 8:00am UTC](https://discuss.elastic.co/t/elapsed-expired-error-event-is-not-generated-for-same-repeated-logs/160316 "2018-12-11T08:00:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![shwesinhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwesinhan/32/78663_2.png) [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 11, 2018, 8:00am UTC](https://discuss.elastic.co/t/elapsed-expired-error-event-is-not-generated-for-same-repeated-logs/160316/1 "2018-12-11T08:00:28Z")

</div>

hi there

i use logstash elapsed filter to get latency between req and resp logs  
logstash elapsed help me a lot. but for repeated req (same unique\_id\_field) logs it doesn't show correct count.

here i test elapsed config

> elapsed {  
> start\_tag =\> "app1\_req"  
> end\_tag =\> "app1\_res"  
> unique\_id\_field =\> "app\_id"   
> periodic\_flush =\> true  
> timeout =\> 60  
> add\_tag =\> ["app1"]  
> new\_event\_on\_match =\> true  
> }

i send app1\_req `8 times` with `same app_id` within 5 mins and i don't send app1\_res.  
because i want to know how may elapsed\_expired\_error events i get.  
and i only ` got 3` elapsed\_expired\_error events. why?  
it supposes to be ` 8` right?  
because of overwirte before periodic\_flush do?

does anybody plz explain to me?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2019, 8:00am UTC](https://discuss.elastic.co/t/elapsed-expired-error-event-is-not-generated-for-same-repeated-logs/160316/2 "2019-01-08T08:00:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
