# Help me with logstash config (Feature Request)

**URL:** <https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992>\
**Category:** Logstash\
**Created:** [January 12, 2023, 7:14am UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992 "2023-01-12T07:14:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Md\_Shariful\_Islam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/md_shariful_islam/32/99030_2.png) [@Md\_Shariful\_Islam](https://discuss.elastic.co/u/Md_Shariful_Islam)\
**Post date:** [January 12, 2023, 7:14am UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992/1 "2023-01-12T07:14:19Z")

</div>

```auto

```

I am using logstash aggregate filter and I want timeout value for infinite time. How to do that?

Current config for aggregate filter given below

```auto
if [src_ip] {
        aggregate {
            task_id => "%{src_ip}"
            code => "
                if !defined?(map)
                    map = Hash.new
                end
                if event.get('user_mac')
                    map['getmac'] = event.get('user_mac')
                end
                if event.get('user')
                    map['getuser'] = event.get('user')
                end
				event.set('pppoeusermac', map['getmac']);
				event.set('pppoeuser', map['getuser'])
			"
            timeout_task_id_field => "%{src_ip}"
            aggregate_maps_path => "/home/user/logstash-8.3.2/data/aggmap/aggregate_maps"
        }
    }

```

```auto

```

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [January 12, 2023, 1:56pm UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992/2 "2023-01-12T13:56:56Z")

</div>

Have you tried to set timeout = 0? I guess that :D. I do not test this option.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/5/159683780cbf775238d7ce71184b5c7020fce9f8.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 12, 2023, 5:55pm UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992/3 "2023-01-12T17:55:47Z")

</div>

> [@Md\_Shariful\_Islam](#):
>
> I want timeout value for infinite time.

I don't think you can make it infinite, but you can set it to a very large number, like 2147483647, which is over 68 years. Make sure you set inactivity\_timeout as well.

---

<div class="post-metadata">

**Author:** ![Md\_Shariful\_Islam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/md_shariful_islam/32/99030_2.png) [@Md\_Shariful\_Islam](https://discuss.elastic.co/u/Md_Shariful_Islam)\
**Post date:** [January 15, 2023, 5:20am UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992/4 "2023-01-15T05:20:39Z")

</div>

I tried it initially but cpu usage and memory usage got high, so I am looking for a solution which will keep the last map value for each task id.

---

<div class="post-metadata">

**Author:** ![Md\_Shariful\_Islam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/md_shariful_islam/32/99030_2.png) [@Md\_Shariful\_Islam](https://discuss.elastic.co/u/Md_Shariful_Islam)\
**Post date:** [January 15, 2023, 5:30am UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992/5 "2023-01-15T05:30:36Z")

</div>

Yes, I tried with both negative value and zero but it doesn't work. It's not setting pppoeusermac and pppoeuser for each upcoming event

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2023, 5:30am UTC](https://discuss.elastic.co/t/help-me-with-logstash-config-feature-request/322992/6 "2023-02-12T05:30:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.