I am using logstash aggregate filter and I want timeout value for infinite time. How to do that?
Current config for aggregate filter given below
if [src_ip] {
aggregate {
task_id => "%{src_ip}"
code => "
if !defined?(map)
map = Hash.new
end
if event.get('user_mac')
map['getmac'] = event.get('user_mac')
end
if event.get('user')
map['getuser'] = event.get('user')
end
event.set('pppoeusermac', map['getmac']);
event.set('pppoeuser', map['getuser'])
"
timeout_task_id_field => "%{src_ip}"
aggregate_maps_path => "/home/user/logstash-8.3.2/data/aggmap/aggregate_maps"
}
}