# Logstash aggregate filter sum incorrect

**URL:** <https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199>\
**Category:** Logstash\
**Created:** [August 23, 2021, 8:40am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199 "2021-08-23T08:40:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zhyp](https://avatars.discourse-cdn.com/v4/letter/z/91b2a8/32.png) [@zhyp](https://discuss.elastic.co/u/zhyp)\
**Post date:** [August 23, 2021, 8:40am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199/1 "2021-08-23T08:40:29Z")

</div>

Hi,

🙂

Here is my es data.I can query them correctly.

{"count":1,"time":"2021-08-10T00:15:00.000+08:00"}  
{"count":2,"time":"2021-08-10T00:30:00.000+08:00"}

I want to sum the count by day.

Here are the results I want.

{"count":3,"time":"2021-08-10T00:00:00.000+08:00"}

Here is the filter configuration.I use version 7.12.0.I refer to the official website example.[Aggregate filter plugin | Logstash Reference [7.12] | Elastic](https://www.elastic.co/guide/en/logstash/7.12/plugins-filters-aggregate.html#plugins-filters-aggregate-example5)

filter {  
ruby {  
code =\> "event.set('date', event.get('time')[0..9] + 'T00:00:00.000+08:00')"  
}  
aggregate {  
task\_id =\> "%{date}"  
code =\> "map['count'] ||= 0; map['count'] += event.get('count');"  
push\_map\_as\_event\_on\_timeout =\> true  
timeout\_task\_id\_field =\> "date"  
timeout =\> 3600 # 1 hour timeout, user activity will be considered finished one hour after the first event, even if events keep coming  
inactivity\_timeout =\> 300 # 5 minutes timeout, user activity will be considered finished if no new events arrive 5 minutes after the last event  
timeout\_tags =\> ['\_aggregatetimeout']  
timeout\_code =\> "event.set('several\_clicks', event.get('count') \> 1)"  
}  
}

Here are my results.It doesn't work properly.It seems that there is the last record.

{"count":2,"date":"2021-08-10T00:00:00.000+08:00"}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2021, 8:41am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199/2 "2021-09-20T08:41:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.