Logstash aggregation filter configuration

Elastic Stack Logstash
1

Hi there

I'm hoping someone can help me with this please. If I have an input file in json format with a field named uuid that I wish to use as a task id in the logstash aggregate plugin. What is the correct syntax to use to specify this?

Should it be task_id => "uuid" or task_id=>event['uuid'] or something else. I can't get it to work at present and any help would be appreciated.

Thanks
Paul G

2 
task_id => "%{task_id}"

Documented here: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf

3

Thanks very much!