# Filter aggregate and timeout

**URL:** <https://discuss.elastic.co/t/filter-aggregate-and-timeout/46717>\
**Category:** Logstash\
**Created:** [April 7, 2016, 4:16pm UTC](https://discuss.elastic.co/t/filter-aggregate-and-timeout/46717 "2016-04-07T16:16:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gnosis](https://avatars.discourse-cdn.com/v4/letter/g/3e96dc/32.png) [@Gnosis](https://discuss.elastic.co/u/Gnosis)\
**Post date:** [April 7, 2016, 4:16pm UTC](https://discuss.elastic.co/t/filter-aggregate-and-timeout/46717/1 "2016-04-07T16:16:43Z")

</div>

Hi all,

Imagine several lines with a key and a letter like this :

> key1 - Q  
> key2 - Q  
> key1 - A  
> key1 - C

with Q =\> Qestion ; A =\> Answer ; C =\> Close

My aim is to know when i don't have "A" for a "Q".  
So i use the aggregate plugin and all is ok WHEN i have a Close state.  
Indeed, i add a field in my event and i can answer to my question.

But when i don't have the C, i can't get the information of the end.  
i've seen that it exists "timeout" but i don't know how to trap that.

Here is my code for the example i give ( for information, STATE is the field where i concatenate the Q, A and F ; the FINAL\_FIELD is just a 'flag field' to say : 'Yes that's the end' ) :

```
aggregate {
       task_id => "%{FIELD1}"
       code => "map['state'] ||= '' ; map['state'] += event['FIELD2'] ; event['STATE'] = map['STATE']"
       }

if [FIELD2] == 'C' {
aggregate {
       add_field => { "FINAL_FIELD" => "Y"}
       task_id => "%{FIELD1}"
       code => "event['STATE'] = map['STATE']"
       end_of_task => true
       }
}

```

Someone could help plz ??

Thx.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/filter-aggregate-and-timeout/46717/2 "2017-07-06T05:03:15Z")

</div>

Closed on July 6, 2017, 5:03am UTC