Logstash aggregate filter sum incorrect



Here is my es data.I can query them correctly.


I want to sum the count by day.

Here are the results I want.


Here is the filter configuration.I use version 7.12.0.I refer to the official website example.Aggregate filter plugin | Logstash Reference [7.12] | Elastic

filter {
ruby {
code => "event.set('date', event.get('time')[0..9] + 'T00:00:00.000+08:00')"
aggregate {
task_id => "%{date}"
code => "map['count'] ||= 0; map['count'] += event.get('count');"
push_map_as_event_on_timeout => true
timeout_task_id_field => "date"
timeout => 3600 # 1 hour timeout, user activity will be considered finished one hour after the first event, even if events keep coming
inactivity_timeout => 300 # 5 minutes timeout, user activity will be considered finished if no new events arrive 5 minutes after the last event
timeout_tags => ['_aggregatetimeout']
timeout_code => "event.set('several_clicks', event.get('count') > 1)"

Here are my results.It doesn't work properly.It seems that there is the last record.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.