How to set filter integer settings based on event filed or metadata

[Tomasz_Macioszek (SantaTM)]

Hi All,

I would like to set filter settings - aggregate filter timeout value - based on event field or metadata.
I have converted metadata to integere
mutate { convert => { "[@metadata][taskID_timeout]" => "integer" } }

and next try to use this value in aggregate filter (set timeout value):
aggregate {
task_id => "%{taskID}"
code => "
map['problem_duration'] = event.get('epoc')
"
push_map_as_event_on_timeout => true
timeout_task_id_field => "event_id"
#timeout => "%{[@metadata][taskID_timeout]}

                    inactivity_timeout => 30
                    timeout_tags => ['_aggregatetimeout']
                    timeout_code => "event.set('problem_duration', map['problem_duration'])"
            }

but logstash don't start and log error:
[ERROR] 2018-08-31 08:28:02.768 [Converge PipelineAction::Create] aggregate - Invalid setting for aggregate filter plugin:

filter {
aggregate {
# This setting must be a number
# Expected number, got "%{[@metadata][taskID_timeout]}" (type %{[@metadata][taskID_timeout]})
timeout => "%{[@metadata][taskID_timeout]}"
...
}
}

I know that it is possible to set string settings for example elasticsearch output settings:
action => "%{[@metadata][action]}"
document_id => "%{[@metadata][_id]}"

but what with integer settings?
Any idea? Any help?

BR
TM

[Tomasz_Macioszek (SantaTM)]

Little update on aggregate filter code, my mistake:

aggregate {
task_id => "%{taskID}"
code => "
map['problem_duration'] = event.get('epoc')
"
push_map_as_event_on_timeout => true
timeout_task_id_field => "event_id"
timeout => "%{[@metadata][taskID_timeout]}
timeout_tags => ['_aggregatetimeout']
timeout_code => "event.set('problem_duration', map['problem_duration'])"
}

BR
TM