# Logstash Aggregate plugin don´t aggregate

**URL:** <https://discuss.elastic.co/t/logstash-aggregate-plugin-don-t-aggregate/110338>\
**Category:** Logstash\
**Created:** [December 5, 2017, 12:12pm UTC](https://discuss.elastic.co/t/logstash-aggregate-plugin-don-t-aggregate/110338 "2017-12-05T12:12:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gleberrl](https://avatars.discourse-cdn.com/v4/letter/g/b782af/32.png) [@gleberrl](https://discuss.elastic.co/u/gleberrl)\
**Post date:** [December 5, 2017, 12:12pm UTC](https://discuss.elastic.co/t/logstash-aggregate-plugin-don-t-aggregate/110338/1 "2017-12-05T12:12:29Z")

</div>

I have this logs and need aggregate to selected fields:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b9d7ec78b91fafb6eef3995a48224ff10e32b37.png)

I don´t have error log, but I not see aggregated log´s

My logstash aggregate config:

```
            if [type] == "Logs-Clientes" {
                    aggregate {
                            task_id => "%{user}%{src_address}%{src_port}%{dst_address}%{dst_port}"
                            code => "map['c_bytes'] ||= 0 ; map['c_bytes'] += event.get('bytes')"
                            timeout => 5
                            timeout_tags => ['_aggregatetimeout']
                            timeout_code => "event.set('bytes', map['c_bytes'])"
                    }
            }
           if "_aggregatetimeout" not in [tags] {
                   drop {}
           }

```

Thank´s

---

<div class="post-metadata">

**Author:** ![gleberrl](https://avatars.discourse-cdn.com/v4/letter/g/b782af/32.png) [@gleberrl](https://discuss.elastic.co/u/gleberrl)\
**Post date:** [December 11, 2017, 3:11pm UTC](https://discuss.elastic.co/t/logstash-aggregate-plugin-don-t-aggregate/110338/3 "2017-12-11T15:11:14Z")

</div>

Hi,

when I put this function, my problem it´s resolved!

```
            if [type] == "Logs-Clientes" {
                    aggregate {
                            task_id => "%{user}_%{src_address}_%{src_port}_%{dst_address}_%{dst_port}"
                            code => "map['sum_bytes'] ||= 0 ;
                                    map['sum_bytes'] += event.get('lenght') ;
                                    map['my_count'] ||= 0 ;
                                    map['my_count'] += 1 ;
                                    if map['my_count'] == 40
                                            event.set('bytes', (map['sum_bytes']))
                                            event.set('Aggregation', true)
                                            map['sum_bytes'] = 0
                                            map['my_count'] = 0
                                    end
                            "
                    }
                    if [Aggregation] {
                            aggregate {
                                    task_id => "%{user}_%{src_address}_%{src_port}_%{dst_address}_%{dst_port}"
                                    code => ""
                                    end_of_task => "true"
                            }
                    }
                    if (![Aggregation]) {
                            drop {}
                    }

                    mutate {
                            remove_field => ["lenght", "Aggregation"]
                    }

            }

```

Thanks

---

<div class="post-metadata">

**Author:** ![gleberrl](https://avatars.discourse-cdn.com/v4/letter/g/b782af/32.png) [@gleberrl](https://discuss.elastic.co/u/gleberrl)\
**Post date:** [December 11, 2017, 3:12pm UTC](https://discuss.elastic.co/t/logstash-aggregate-plugin-don-t-aggregate/110338/4 "2017-12-11T15:12:17Z")

</div>

Solved!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2018, 3:12pm UTC](https://discuss.elastic.co/t/logstash-aggregate-plugin-don-t-aggregate/110338/5 "2018-01-08T15:12:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.