# Logstash - aggregate filter - for each transaction/thread, only look for the first match message

**URL:** https://discuss.elastic.co/t/logstash-aggregate-filter-for-each-transaction-thread-only-look-for-the-first-match-message/202936
**Category:** Logstash
**Created:** [October 10, 2019, 3:23am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-for-each-transaction-thread-only-look-for-the-first-match-message/202936 "2019-10-10T03:23:29Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Vincent\_Chen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vincent_chen/32/43352_2.png) [@Vincent\_Chen](https://discuss.elastic.co/u/Vincent_Chen)
#### Post date: [October 10, 2019, 3:23am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-for-each-transaction-thread-only-look-for-the-first-match-message/202936/1 "2019-10-10T03:23:29Z")

</div>

Hi everyone,

We have a log that do not provide a unique ID for each transaction.

We want to use the thread-id and the message body to define the transaction boundary.

Here is the mock-up log:

> ##transaction 1  
> [2019-09-27 10:16:50,170], info, thread1, start  
> [2019-09-27 10:16:50,171], info, thread1, received  
> [2019-09-27 10:16:50,172], info, thread1, end  
> #transaction 2  
> [2019-09-27 10:16:51,180], info, thread1, start  
> [2019-09-27 10:16:51,181], info, thread1, received  
> [2019-09-27 10:16:51,182], info, thread1, end

Here is my filter:

```
  if [msg] =~ "start" {
aggregate {
  task_id => "%{thread}"
  code => "map['new_msg'] ||= event.get('message')"
  map_action => "create"
  }
  }

  if [msg] =~ "received" {
  aggregate {
  task_id => "%{thread}"
  code => "map['new_msg'] << event.get('message')"
  map_action => "update"
}  
  }

 if [msg] =~ "end" {
aggregate {
  task_id => "%{thread}"
  code => "map['new_msg'] << event.get('message'); event.set('new_msg', map['new_msg'])"
  map_action => "update"
  end_of_task => true
  timeout => 10
}
}  

```

Here is the output:

> [2019-09-27 10:16:50,170], info, threadid-1, start  
> [2019-09-27 10:16:50,171], info, threadid-1, received  
> [2019-09-27 10:16:51,181], info, threadid-1, received  
> [2019-09-27 10:16:50,182], info, threadid-1, end

We can see the process treat the "received" event from the second transaction as the first transaction.

Could we tell the aggregate filter to only look for the first match event?

Cheers,  
Vincent

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 7, 2019, 3:23am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-for-each-transaction-thread-only-look-for-the-first-match-message/202936/2 "2019-11-07T03:23:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.