# How to use event.set to get the values of a variable?

**URL:** <https://discuss.elastic.co/t/how-to-use-event-set-to-get-the-values-of-a-variable/340155>\
**Category:** Logstash\
**Created:** [August 4, 2023, 5:41pm UTC](https://discuss.elastic.co/t/how-to-use-event-set-to-get-the-values-of-a-variable/340155 "2023-08-04T17:41:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohsin106](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohsin106/32/65203_2.png) [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Post date:** [August 4, 2023, 5:41pm UTC](https://discuss.elastic.co/t/how-to-use-event-set-to-get-the-values-of-a-variable/340155/1 "2023-08-04T17:41:47Z")

</div>

I'm using Kafka's input plugin within my logstash pipline and I have enabled `decorated_events => true`

If I want to get the kafka topic and partition names I can do this:

```auto
     mutate {
         add_field => { "[topic_name]" => "%{[@metadata][kafka][topic]}"}
         add_field => { "[partition]" => "%{[@metadata][kafka][partition]}"}
     }

```

However, I'm trying to use event.set inside of the `aggregate` plugin to capture the same data, but its not working.

This is my `aggregate` plugin (please see the second to last line):

```auto
if [in-octets] and [out-octets] {
            aggregate {
                remove_field => ["state"]
                task_id => "%{device}-%{interface-name}_mbps"
                timeout_task_id_field => "timeout-mbps"
                inactivity_timeout => 90
                timeout_timestamp_field => "@timestamp"
                push_map_as_event_on_timeout => true
                timeout_tags => ['_done']
                code => "
                if map['previousTime'] == nil
                map['previousTime'] = event.get('timestamp');
                map['previousInOctets'] = event.get('in-octets');
                map['previousOutOctets'] = event.get('out-octets');
                else
                map['timeDifference'] = event.get('timestamp') - map['previousTime'];
                map['inOctetsDiff'] = event.get('in-octets') - map['previousInOctets'];
                map['outOctetsDiff'] = event.get('out-octets') - map['previousOutOctets'];

                # Division by zero check here
                if map['timeDifference'] > 0
                map['in-mbps'] = map['inOctetsDiff'].to_f / map['timeDifference'].to_f * 8.0 / 1000.0 / 1000.0;
                map['out-mbps'] = map['outOctetsDiff'].to_f / map['timeDifference'].to_f * 8.0 / 1000.0 / 1000.0;
                else
                # Set difference to 0
                map['in-mbps'] = 0
                map['out-mbps'] = 0
                end
                map['previousTime'] = event.get('timestamp');
                map['previousInOctets'] = event.get('in-octets');
                map['previousOutOctets'] = event.get('out-octets');
                event.set('in-mbps', map['in-mbps'].round(3));
                event.set('out-mbps', map['out-mbps'].round(3));
                if map['description'] != nil
                event.set('description', map['description']);
                end
                if map['admin-status'] != nil
                event.set('admin-status', map['admin-status']);
                end
                if map['in-errors'] != nil
                event.set('in-errors', map['in-errors']);
                end
                if map['out-errors'] != nil
                event.set('out-errors', map['out-errors']);
                end
                event.set('site', event.get('device')[0..3])
                event.set('a-node', event.get('device').split('.')[0])
                event.set('topic_name', map["%{[@metadata][kafka][partition]]}")
                end
                "
            }
        }
    }

```

I have also tried `map[[@metadata][kafka][partition]]` but that didn't work either. How can I accomplish this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 4, 2023, 10:34pm UTC](https://discuss.elastic.co/t/how-to-use-event-set-to-get-the-values-of-a-variable/340155/2 "2023-08-04T22:34:59Z")

</div>

> [@mohsin106](#):
>
> `event.set('topic_name', map["%{[@metadata][kafka][partition]]}")`

If you use event.set then that modifies the event that is passing through the aggregate filter. You never add anything like [@metadata][kafka][partition] to the map, so that will set [topic\_name] to nil.

I suspect that what you want is

```
map["topic_name"] = event.get("[@metadata][kafka][partition]")

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2023, 10:35pm UTC](https://discuss.elastic.co/t/how-to-use-event-set-to-get-the-values-of-a-variable/340155/3 "2023-09-01T22:35:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.