# Logstash aggregation filter
**URL:** https://discuss.elastic.co/t/logstash-aggregation-filter/244730
**Category:** Logstash
**Created:** [August 12, 2020, 1:48pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730 "2020-08-12T13:48:45Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [August 12, 2020, 1:48pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/1 "2020-08-12T13:48:45Z")
Hi all,
I am trying to aggregate information of multi events to one event using aggregation filter of logstash. for example events are as following:
```
name1=c1,name2=s1
name1=c1,name2=s1
name1=c1,name2=s1
name1=c1,name2=s2
name1=c1,name2=s2
name1=c2,name2=s1
name1=c2,name2=s1
```
the expected output should be as following so that shows count of fields:
c1,s1,3
c1,s2,2
c2,s1,2
for this purpose i used following aggregation filter:
```
aggregate {
task_id => "%{%{name1}_%{name2}}"
code => "
map['count'] ||= 0
map['count'] +=1
"
}
```
whereas the output is as following:
```
c1,s1,1
c1,s1,2
c1,s1,3
c1,s2,1
c1,s2,2
c2,s1,1
c2,s1,2
```
How can i solve this issue?
any advise will be so appreciated.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 12, 2020, 2:27pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/2 "2020-08-12T14:27:35Z")
The aggregate filter is good as far as it goes, but nothing will ever trigger it to push the data from the map as an event. If the data is sorted you can do something like [example 4](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example4). If it is not sorted you can use a timeout, like example 3, but make sure you disable java\_execution!
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [August 12, 2020, 2:45pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/3 "2020-08-12T14:45:22Z")
I set "pipeline.java\_execution: false" in the logstash.yml and change aggregate filter as following:
```
aggregate {
task_id => "%{aggregate_id}"
code => "
map['company_count'] ||= 0
map['company_count'] +=1
event.cancel()
"
push_map_as_event_on_timeout => true
timeout => 180
}
```
but still output is same as last comment. it is noted that output is not sorted and just is example. it seems each value of count will be printed instead of printing last amount of count
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 12, 2020, 2:47pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/4 "2020-08-12T14:47:12Z")
> [@sahere37](#):
>
> `task_id => "%{aggregate_id}"`
Are you creating this field? task\_id =\> "%{name1}\_%{name2}" would probably work.
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [August 12, 2020, 2:48pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/5 "2020-08-12T14:48:44Z")
yes task\_id is value of field aggregat\_id which is based on value of two other fields
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [August 12, 2020, 2:49pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/6 "2020-08-12T14:49:45Z")
indeed value of task\_id will be as following:
c1\_s1
c1\_s2
c2\_s1
---
### Author:  [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [August 12, 2020, 2:54pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/7 "2020-08-12T14:54:12Z")
based on output, it is counting the events which satisfy task\_id but it is expected to print the last value of count which satisfy the task\_id but it will print every value of count(count=1,count=2,count=3,.......)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 9, 2020, 2:54pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730/8 "2020-09-09T14:54:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.