Hi, Is it possible to apply aggregate filter on cef logs. Would you please check my conf file if there is something wrong. it should aggregating when name and sourceAddress are common and increase field aggregatedEvents by 1 every time. below are the conf file: input { udp { port => "516" ty…

You didn't really answer either of my questions, but does this help you? aggregate { task_id => "%{name}_%{sourceAddress}" code => " event.cancel() map['aggregatedEvents'] ||= 0; map['aggregatedEvents'] += 1; " push_map_as_even…

Is it possible to aggregate logs from cef input

Elastic Stack Logstash

saad July 13, 2018, 5:09pm 3

I made as simple as is

aggregatedEvents is to see how many events were creating this aggregated log

for example if its 3 thats mena the 3 logs inlcuded to make the output aggregated log

Topic		Replies	Views
Logstash aggregation filter Logstash	7	324	September 9, 2020
Can't make the "aggregate" filter to work Logstash	1	357	July 6, 2017
Aggregate fields from different event Logstash	4	837	July 6, 2017
Logstash aggregation filter not working properly Logstash	3	1532	July 6, 2017
Using aggregate filter to count number of events and sum field's values Logstash	29	3387	September 14, 2020

Is it possible to aggregate logs from cef input

Related topics