# LogStash-aggregate-filter events in random order

**URL:** <https://discuss.elastic.co/t/logstash-aggregate-filter-events-in-random-order/150676>\
**Category:** Logstash\
**Created:** [October 2, 2018, 10:32am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-events-in-random-order/150676 "2018-10-02T10:32:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sialagio](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sialagio](https://discuss.elastic.co/u/sialagio)\
**Post date:** [October 2, 2018, 10:32am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-events-in-random-order/150676/1 "2018-10-02T10:32:17Z")

</div>

Hello,

Sorry if the is a doublon, I searched, but did not find same topic.

We are working on adding information to events having `MessageTemplate = HTTP {Method} {Path} {StatusCode}`. Information to add would come from `SourceContext=js.ajax` events.  
We have the following specification :

- HTTP event and Ajax event can come in any order
- HTTP events will store the added information
- Ajax event can be missing
- HTTP event can be missing.

We fear about memory leakage or events/data being missed.  
Would this configuration be operational in our scenario ?

```
filter {
	if [SourceContext] == "js.ajax" {
		aggregate {
			task_id => "%{CorrelationId}"
			code => "map['AjaxElapsedMs'] = event.get('ElapsedMs'); map['AjaxBytesTransfered'] = event.get('nbBytesTransfered')"
        		map_action => "create"
        		timeout_tags => ["Aggregate_Ajax_timeout"]
        		timeout => 120
		}
	}
	if [MessageTemplate] == "HTTP {Method} {Path} {StatusCode}" {
		aggregate {
			task_id => "%{CorrelationId}"
			code => "event.set('AjaxElapsedMs', map['AjaxElapsedMs']); event.set('AjaxBytesTransfered', map['AjaxBytesTransfered']);"
			map_action => "update"
			end_of_task => true
			timeout_tags => ["Aggregate_HTTP_timeout"]
			timeout => 120
		}
	}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2018, 10:32am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-events-in-random-order/150676/2 "2018-10-30T10:32:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.