# Event.append() on Logstash 6

**URL:** <https://discuss.elastic.co/t/event-append-on-logstash-6/151927>\
**Category:** Logstash\
**Created:** [October 10, 2018, 7:43pm UTC](https://discuss.elastic.co/t/event-append-on-logstash-6/151927 "2018-10-10T19:43:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![decibel83](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@decibel83](https://discuss.elastic.co/u/decibel83)\
**Post date:** [October 10, 2018, 7:43pm UTC](https://discuss.elastic.co/t/event-append-on-logstash-6/151927/1 "2018-10-10T19:43:36Z")

</div>

I'm trying to use the Logstash aggregate filter on Postfix logs using a filter taken from [https://github.com/topmedia/logstash-postfix/blob/master/etc/logstash/conf.d/51-filter-postfix-aggregate.conf](https://github.com/topmedia/logstash-postfix/blob/master/etc/logstash/conf.d/51-filter-postfix-aggregate.conf).

I modified the filter to use the new `event.get()` function, but I cannot adapt the `event.append()` function because I don't find any reference on the Logstash 6 documentation.

I'm getting the following error:

```
[2018-10-10T21:24:27,243][ERROR][logstash.filters.aggregate] Aggregate exception occurred {:error=>#<TypeError: wrong argument type Hash (expected LogStash::Event)>, :code=>"event.append(map)", :map=>{"..."}

```

This is the filter I'm trying to use:

```
filter {
  date {
    match => ["timestamp", "MMMM dd HH:mm:ss", "MMMM d HH:mm:ss"]
  }

  if ![postfix_queueid] {
    drop {}
  } else if [syslog_program] == "postfix/qmgr" and [postfix_from] {
    aggregate {
      task_id => "%{postfix_queueid}"
      code => "
        map['postfix_from'] = event.get('postfix_from')
        map['postfix_size'] = event.get('postfix_size')
        map['postfix_nrcpt'] = event.get('postfix_nrcpt')
      "
    }
  } else if [syslog_program] == "postfix/smtpd" {
    aggregate {
      task_id => "%{postfix_queueid}"
      code => "
        map['postfix_client_hostname'] = event.get('postfix_client_hostname')
        map['postfix_client_ip'] = event.get('postfix_client_ip')
      "
    }
  } else if [syslog_program] == "postfix/cleanup" {
    aggregate {
      task_id => "%{postfix_queueid}"
      code => "
        map['postfix_message-id'] = event.get('postfix_message-id')
      "
    }
  } else if [syslog_program] == "postfix/smtp" {
    aggregate {
      task_id => "%{postfix_queueid}"
      code => "event.append(map)"
    }
  }
}

```

Thanks!

---

<div class="post-metadata">

**Author:** ![decibel83](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@decibel83](https://discuss.elastic.co/u/decibel83)\
**Post date:** [October 10, 2018, 8:18pm UTC](https://discuss.elastic.co/t/event-append-on-logstash-6/151927/2 "2018-10-10T20:18:43Z")

</div>

I solved this way:

```
  code => "
    map.each do |key, value|
      event.set(key, value)
    end
  "

```

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2018, 8:30pm UTC](https://discuss.elastic.co/t/event-append-on-logstash-6/151927/3 "2018-11-07T20:30:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.