LogStash-aggregate-filter events in random order

Elastic Stack Logstash
1

Hello,

Sorry if the is a doublon, I searched, but did not find same topic.

We are working on adding information to events having MessageTemplate = HTTP {Method} {Path} {StatusCode}. Information to add would come from SourceContext=js.ajax events.
We have the following specification :

  • HTTP event and Ajax event can come in any order
  • HTTP events will store the added information
  • Ajax event can be missing
  • HTTP event can be missing.

We fear about memory leakage or events/data being missed.
Would this configuration be operational in our scenario ?

filter {
	if [SourceContext] == "js.ajax" {
		aggregate {
			task_id => "%{CorrelationId}"
			code => "map['AjaxElapsedMs'] = event.get('ElapsedMs'); map['AjaxBytesTransfered'] = event.get('nbBytesTransfered')"
        		map_action => "create"
        		timeout_tags => ["Aggregate_Ajax_timeout"]
        		timeout => 120
		}
	}
	if [MessageTemplate] == "HTTP {Method} {Path} {StatusCode}" {
		aggregate {
			task_id => "%{CorrelationId}"
			code => "event.set('AjaxElapsedMs', map['AjaxElapsedMs']); event.set('AjaxBytesTransfered', map['AjaxBytesTransfered']);"
			map_action => "update"
			end_of_task => true
			timeout_tags => ["Aggregate_HTTP_timeout"]
			timeout => 120
		}
	}
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.