# How to install plugin?

**URL:** <https://discuss.elastic.co/t/how-to-install-plugin/24796>\
**Category:** Logstash\
**Created:** [July 2, 2015, 12:05pm UTC](https://discuss.elastic.co/t/how-to-install-plugin/24796 "2015-07-02T12:05:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Smasell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smasell/32/43483_2.png) [@Smasell](https://discuss.elastic.co/u/Smasell)\
**Post date:** [July 2, 2015, 12:05pm UTC](https://discuss.elastic.co/t/how-to-install-plugin/24796/1 "2015-07-02T12:05:24Z")

</div>

Hi!!!  
I'm absolutely new in Logstash. And I have a couple of questions:

1. I need to install this plugin [https://github.com/logstash-plugins/logstash-filter-aggregate](https://github.com/logstash-plugins/logstash-filter-aggregate). Tell me please how can I do this?  
My config file parses parameters like this:  
grok {  
match =\> ["message", " id: %{INT:user-id:int};"]  
tag\_on\_failure =\> []  
}  
if [message] =~ /^Deauthorizing client / {  
noop {  
add\_field =\> { "event" =\> "deauthorize" }  
}  
}  
if [message] =~ /^Logged in / {  
noop {  
add\_field =\> { "event" =\> "logged in" }  
}  
}  
I want to add field with session length between "Logged in" and Deauthorizing client" in "Deauthorizing client" documents. All my logs use timestamp.  
Can you help me with config file for this task?  
Many thanks for helping me.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 2, 2015, 10:02pm UTC](https://discuss.elastic.co/t/how-to-install-plugin/24796/2 "2015-07-02T22:02:49Z")

</div>

[The docs](https://www.elastic.co/guide/en/logstash/current/_command_line_flags.html#_plugins) have info on how to install plugins 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/how-to-install-plugin/24796/3 "2017-07-06T05:35:41Z")

</div>