Filter aggregate and timeout

Elastic Stack Logstash
1

Hi all,

Imagine several lines with a key and a letter like this :

key1 - Q
key2 - Q
key1 - A
key1 - C

with Q => Qestion ; A => Answer ; C => Close

My aim is to know when i don't have "A" for a "Q".
So i use the aggregate plugin and all is ok WHEN i have a Close state.
Indeed, i add a field in my event and i can answer to my question.

But when i don't have the C, i can't get the information of the end.
i've seen that it exists "timeout" but i don't know how to trap that.

Here is my code for the example i give ( for information, STATE is the field where i concatenate the Q, A and F ; the FINAL_FIELD is just a 'flag field' to say : 'Yes that's the end' ) :

aggregate {
       task_id => "%{FIELD1}"
       code => "map['state'] ||= '' ; map['state'] += event['FIELD2'] ; event['STATE'] = map['STATE']"
       }

if [FIELD2] == 'C' {
aggregate {
       add_field => { "FINAL_FIELD" => "Y"}
       task_id => "%{FIELD1}"
       code => "event['STATE'] = map['STATE']"
       end_of_task => true
       }
}

Someone could help plz ??

Thx.