I don't know why aggregation is overwritten by last one
following is my logstash code
filter {
aggregate {
task_id => "%{code}"
code => "
map['code'] = event.get('code')
map[event.get('language')] ||= {
'name' => event.get('name')
...
}
push_previous_map_as_event => true
push_map_as_event_on_timeout => true
timeout_task_id_field => "task_id"
timeout => 3000
}
mutate {
copy => { "code" => "[@metadata][_id]" }
remove_field => ["code", "@version", "unix_ts_in_secs"]
}
}
and following is mysql result...
mysql rows =
["code" "language", "name"] = [[10345, "jp", "test1"], [10345, "th", "test2]]
i want to
jp: {
name: "test1"
}
th: {
name: "test2"
}
but result have always just last language data
th: {
name: "test2"
}
i don't know why aggregation doesn't work well