Logstash aggregate problem

[fabryx87]

Hi all,

I am trying to do an aggregate in logstash, but probably i am not understanding how it works....
I want to copy the field contenent of elevated_token inside the map, and create a new field with this value on the end task.
I will need to apply this method to other fields as well.

can you please help me?

if "system_session" not in [tags] {
    aggregate {
      task_id => "%{winlog.event_data.TargetLogonId}"
      code => "map['elevated_token'] += event.get([winlog][event_data][ElevatedToken])"
      map_action => "create"
    }
}
if [winlog][event_id] == 4634{
    aggregate {
          task_id => "%{winlog.event_data.TargetLogonId}"
          code => "event.set('elevated_token', map['elevated_token'])"
          map_action => "update"
          end_of_task => true
          push_map_as_event_on_timeout => true
          timeout_tags => ['_aggregatetimeout']
          timeout => 28800
    }
}

[Badger]

@fabryx87

"%{winlog.event_data.TargetLogonId}"

It seems likely that you mean %{[winlog][event_data][TargetLoginId]}

[fabryx87]

Hi Badger,

thanks for your reply.
unfortunatelly it didn't help, do you have any other suggest?
is there a way to add some tag to check if a step is done or not?

thanks

if "system_session" not in [tags] {
                    mutate {
                     add_field => { "legit" => "yes" }
                    }
                    aggregate {
                         task_id => "%{[winlog][event_data][TargetLoginId]}"
                         code => "map['elevated_token'] += event.get([winlog][event_data][ElevatedToken])"
                         map_action => "create"
                         }
                    }
                }
        }
           if [winlog][event_id] == 4634 or [event][code] == 4647{
           aggregate {
                 task_id => "%{[winlog][event_data][TargetLoginId]}"
                 code => "event.set('elevated_token', map['elevated_token'])"
                 map_action => "update"
                 end_of_task => true
                 push_map_as_event_on_timeout => true
                 timeout_tags => ['_aggregatetimeout']
                 timeout => 28800
            }

[Badger]

@fabryx87

is there a way to add some tag to check if a step is done or not?

add_tag is one of the common options that pretty much every filter supports. That said, adding the tag ("decorating the event") is only done if the filter matches the event. So, for example, in a date or grok filter, if the source field does not exist then nothing is done and the event is not decorated. An aggregate filter will decorate the event unless an error occurs.

[fabryx87]

ok, how can I troubleshoot in this case to understand what is going on and why this aggregate doesn't work?
because it add the field

mutate {
add_field => { "legit" => "yes" }
 }

but I don't have any trace of the aggregate.

[fabryx87]

Any help on this?
thanks