Down below is my code. I have even set the task_id to 1, and used add_tag.
The ruby code had executed, but aggregate doesn't work.
Can someone help?
if [operation] == "receive a request" {
ruby {
code => "
event['here'] = 'here'
"
}
aggregate {
task_id => "1"
code => "map['start_timestamp'] = event['@timestamp']"
map_action => "create_or_update"
add_tag => [ "aggregateStart" ]
}
}
if [operation] == "send a answer" {
ruby {
code => "
event['there'] = 'there'
"
}
aggregate {
task_id => "1"
code => "event['duration'] = event['@timestamp'] - map['start_timestamp']"
map_action => "create_or_update"
end_of_task => true
add_tag => [ "aggregateEnd" ]
timeout => 120
}
}