Maybe you can use aggregate filter :
When start event occurs, you compute session I'd, and you store it in aggregate map until the end of the session in the logs.
At the session end (in the logs), you delete the map, using end_of_task=true
1 Like