I'm a big fan of logstash-aggregate filter and we're using it in the production system. As for this topic, I can see the aggregate version 2.5.1 seems having fixed this bug only with logstash 2.4 or later. But we want to keep the existing logstash 2.3.2 and hope to have this fix with it, as a sort of aggregate 2.4.1. Wondering this is is a quick fix and doable sooner or later.
So you need logstash-filter-aggregate v2.5.1 but that requires Logstash 2.4 and you don't want to upgrade Logstash? If yes then your best bet is to build your own gem after cherry-picking the commit or commits you need onto the last commit that supports Logstash 2.3. This might not be entirely trivial.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.