# Issue with Aggregate task\_id undefined variable

**URL:** <https://discuss.elastic.co/t/issue-with-aggregate-task-id-undefined-variable/102314>\
**Category:** Logstash\
**Created:** [September 29, 2017, 8:41pm UTC](https://discuss.elastic.co/t/issue-with-aggregate-task-id-undefined-variable/102314 "2017-09-29T20:41:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ffernandez](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@ffernandez](https://discuss.elastic.co/u/ffernandez)\
**Post date:** [September 29, 2017, 8:41pm UTC](https://discuss.elastic.co/t/issue-with-aggregate-task-id-undefined-variable/102314/1 "2017-09-29T20:41:26Z")

</div>

Hello!

I'm trying to use the aggregate filter plugin to merge a couple of events using the field "thread" obtained via the grok filter plugin. However, every time I try to run logstash, whether is from the cli or systemd start logstash I keep getting the following error:

> Environment variable `thread` is not set and there is no default value given.

This is the relevant part of the filter code I'm using:

> filter {  
> grok {  
> match =\> { "message" =\> "[%{TIMESTAMP\_ISO8601:timestamp}] [thread %{POSINT:thread}] [client %{IPORHOST:clientip}:%{POSINT:clientport}]" }  
> }  
> aggregate {  
> aggregate\_maps\_path =\> "/var/log/logstash/aggregate\_maps"  
> task\_id =\> "${thread}"  
> code =\> "map['dynafed'] ||= event.get(['dynafed']['path'])"  
> push\_previous\_map\_as\_event =\> true  
> timeout =\> 1  
> }  
> }

I have tried changing it to "${[thread]} but then I get an error saying it needs to contain a dynamic expression like %{field}

I can use that "thread" variable within other plug-ins however, like mutate, or as a conditional (not that I want to do that just doing so to test it).

I have also tried something like below just to test:

> aggregate {  
> add\_field =\> "thread\_id" = %{thread}  
> task\_id =\> "%{thread\_id}"  
> code =\> "map['dynafed'] ||= event.get(['dynafed']['path'])"  
> push\_previous\_map\_as\_event =\> true  
> timeout =\> 1  
> }

and I get the same "undefined variable" error as before. It's as if the aggregate block is working on a different scope.

So I'm not sure if I'm doing something wrong or maybe I found a bug? Let me know if you need any more info.

I'm using logstash 5.6.2 and the logstash-filter-aggregate is 2.6.3 on CentOS 7.3

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![ffernandez](https://avatars.discourse-cdn.com/v4/letter/f/94ad74/32.png) [@ffernandez](https://discuss.elastic.co/u/ffernandez)\
**Post date:** [October 3, 2017, 6:14pm UTC](https://discuss.elastic.co/t/issue-with-aggregate-task-id-undefined-variable/102314/2 "2017-10-03T18:14:15Z")

</div>

Never mind, I'm an idiot, should be %{thread} not ${thread} 🙄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2017, 6:14pm UTC](https://discuss.elastic.co/t/issue-with-aggregate-task-id-undefined-variable/102314/3 "2017-10-31T18:14:32Z")

</div>

Closed on October 31, 2017, 6:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.