How to add timestamp to aggregate filter

Elastic Stack Logstash
1

filter contents below, timeevent should display current timestamp

aggregate {

		task_id => "%{ENVIRONMENT_ID}_%{SPN_FIRM_ID}_%{ENTITY_TYPE}_%{ENTITY_ID}"
		code => '
			map["keyInformation"] ||= {}
			map["keyInformation"]["environmentId"]  = event.get("ENVIRONMENT_ID")
			map["keyInformation"]["entityId"] = event.get("ENTITY_ID")
			map["keyInformation"]["entityType"] = event.get("ENTITY_TYPE")
			map["keyInformation"]["firmId"] = event.get("SPN_FIRM_ID")
			
		
			map["associatedSleeves"] ||= [] 
			map["associatedSleeves"] << { 
			 "sleeveId" => event.get("SLV_ID") ,
			 "type" => event.get("SUB_MODEL_ID") ,
			 "nickname" => event.get("OWNER_ID") ,
			 "timeevent" => "%{@timestamp}" 
			}			
			event.cancel
		'
		push_map_as_event_on_timeout => true
		timeout => 2
    }

current output:

      "associatedSleeves" : [
        {
          "nickname" : "1",
          "type" : "1",
          "timeevent" : "%{@timestamp}",
          "sleeveId" : "146180"
        },
        {
          "nickname" : "2",
          "type" : "1",
          "timeevent" : "%{@timestamp}",
          "sleeveId" : "146181"
        }
      ],
      "keyInformation" : {
        "entityId" : "363147",
        "environmentId" : "QA_FDX",
        "firmId" : "101",
        "entityType" : "AC",
        "lastUpdated" : "2019-10-24T17:22:47.087Z"
      }
2

Use event.get just as you did for the other fields.

3

@Badger Perfect it works ..Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.