# Event aggregation with logstash error due to mixed task\_id

**URL:** <https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705>\
**Category:** Logstash\
**Created:** [March 3, 2022, 7:18am UTC](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705 "2022-03-03T07:18:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [March 3, 2022, 7:18am UTC](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705/1 "2022-03-03T07:18:10Z")

</div>

Hi all  
I have a case like this:  
my email log has a task\_id i called it event.id due to how the log was configed now all the log are seperated and only joined by the event.id field.  
Now i've tried to use the aggregate in logstash to put all the log together but then the thing i notices is that event if i set the timeout for the aggregate plugin. It can only mapp all event that has the same event.id that goes after the same event.id

To better explain it i have a little example:  
i have 2 id: aaa and bbb  
now aaa id have 3 log and bbb have 2  
the course of the log will goes like this to elastic:  
aaa  
aaa  
bbb  
bbb  
aaa

then i notices that the first 2 aaa id will be aggregated. the last aaa id did not get aggregated to the same event as the other 2 since the id bbb got process in the middle.

I want to know if there is any other way to fix this issue to enable me the aggregate all 3 aaa id event in the same event that got push to elastic

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 3, 2022, 5:43pm UTC](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705/2 "2022-03-03T17:43:41Z")

</div>

What does your aggregate filter configuration look like?

---

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [March 4, 2022, 9:03am UTC](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705/3 "2022-03-04T09:03:38Z")

</div>

It looks like this:

```auto
filter {
  aggregate {
    task_id => "%{mail.session_id}"
    code => "
      map['@timestamp'] ||= event.get('@timestamp')
      map['source.ip'] ||= event.get('mail.client.ip')
      map['user.name'] ||= event.get('user.name')
      map['mail'] ||= []
      map['mail'] << {'data' => event.get('mail.data')}
      map['mail'] << {'context' => event.get('mail.context')}
    "
    push_previous_map_as_event => true
    timeout_task_id_field => "mail.session_id"
    timeout => 90
    inactivity_timeout => 75
    timeout_tags => ['_aggregatetimeout']
  }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 4, 2022, 4:02pm UTC](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705/4 "2022-03-04T16:02:53Z")

</div>

> [@lusynda](#):
>
> `push_previous_map_as_event => true`

That says to push an event every time the task\_id changes, so after seeing two aaa events it sees a bbb event and pushes the two aggregated aaa events. You could try using push\_map\_as\_event\_on\_timeout instead.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2022, 4:03pm UTC](https://discuss.elastic.co/t/event-aggregation-with-logstash-error-due-to-mixed-task-id/298705/5 "2022-04-01T16:03:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.