Hello,
I try to aggregate some events coming from the jmx plugin, but I never managed to aggregate anything. As if that was not possible...
Here the code I have so far:
filter {
grok {
match => { "metric_path" => "(?<alias>[^\.]*)\.(?<jmx_path>.*)\.(?<jmx_attribute>[^\.]*)" }
add_field => {
"%{jmx_attribute}" => "%{metric_value_number}"
}
}
aggregate {
task_id => "%{jmx_path}"
code => "event.set('dummyKey', 'dummyValue')"
inactivity_timeout => 10
}
}
In ElasticSearch, I can see the dummyKey
field, so my aggregation code is actually executed.
However, nothing is aggregated at all. If I have 10 input events, then I got 10 output event, all of them with the dummyKey
field populated.
Is this type of aggregation possible with this plugin ? Am I missing something ? Any chance to have a working sample ?
Thanks in advance.