# Getting error when using 'aggregate' in logstash 5.4

**URL:** https://discuss.elastic.co/t/getting-error-when-using-aggregate-in-logstash-5-4/90831
**Category:** Logstash
**Created:** [June 26, 2017, 2:33pm UTC](https://discuss.elastic.co/t/getting-error-when-using-aggregate-in-logstash-5-4/90831 "2017-06-26T14:33:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Ankit\_Gupta](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@Ankit\_Gupta](https://discuss.elastic.co/u/Ankit_Gupta)
#### Post date: [June 26, 2017, 2:33pm UTC](https://discuss.elastic.co/t/getting-error-when-using-aggregate-in-logstash-5-4/90831/1 "2017-06-26T14:33:40Z")

</div>

Hello Everyone,

I am new to logstash and using it to process Netflow data. I am trying to aggregate few events but I am getting error with 'task\_id' and couldn't figure out what wrong I am doing. I am pasting my filter configuration and it will be great if I can get some pointers to identify my mistake. Please let me now if any further details are required.

Logstash: 5.4.1

Filter Conf:

filter {  
ruby { init =\> 'require "ipaddr"'  
code =\> " event.set('[netflow][in\_bits]', event.get('[netflow][in\_bytes]').to\_i \* 8)  
ipa = event.get('[netflow][ipv4\_dst\_addr]').to\_s  
ipm = event.get('[netflow][dst\_mask]').to\_s  
timediff = (Time.parse(event.get('[netflow][last\_switched]')).to\_i) - (Time.parse(event.get('[netflow][first\_switched]')).to\_i)  
back = String.new('/')  
ips = ipa + back + ipm  
ip = IPAddr.new ips

```
             bps = event.get('[netflow][in_bits]').to_i / timediff.to_i if timediff.to_i >0
             event.set('[netflow][prefix]',ip.to_s)
             event.set('[netflow][traffic_rate]',bps)
             "
   }

```

aggregate {  
task\_id =\> event.get('[netflow][prefix]').to\_s  
code =\> " map['prefix'] = event.get('[netflow][prefix]').to\_s  
map['[netflow][traffic\_rate]'] ||= 0  
map['[netflow][traffic\_rate]'] += event.get('[netflow][traffic\_rate]').to\_i  
event.set('[netflow][agg\_rate]', map['[netflow][traffic\_rate]'])  
"  
push\_previous\_map\_as\_event =\> true  
timeout =\> 3  
}

}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 24, 2017, 2:33pm UTC](https://discuss.elastic.co/t/getting-error-when-using-aggregate-in-logstash-5-4/90831/2 "2017-07-24T14:33:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.