# Logstash elapsed filter plugin: can't connect start and end events

**URL:** <https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927>\
**Category:** Logstash\
**Created:** [August 19, 2021, 8:21am UTC](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927 "2021-08-19T08:21:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexandrpaliy](https://avatars.discourse-cdn.com/v4/letter/a/f0a364/32.png) [@alexandrpaliy](https://discuss.elastic.co/u/alexandrpaliy)\
**Post date:** [August 19, 2021, 8:21am UTC](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927/1 "2021-08-19T08:21:00Z")

</div>

Hi.  
Currently, my logstash filter looks something like this:

```auto
filter {
  if ('text1' in [message]) {
    grok {
      ...
      add_tag => ["connection_established"]
    }

    aggregate {
      ...
    }

    elapsed {
      start_tag => "connection_established"
      end_tag => "connection_delete"
      unique_id_field => "conn_fingerprint"        
    }
  }
  else if ('text2' in [message]) {
    grok {
      ...
      add_tag => ["connection_delete"]
    }

    aggregate {
      ...
    }

    elapsed {
      start_tag => "connection_established"
      end_tag => "connection_delete"
      unique_id_field => "conn_fingerprint"
      add_field => {
          "connection_duration" => "%{elapsed_time}"
      }
    }
  }
}

```

But, checking results, I see that elapsed plugin is not working correctly - for every "end event" (events with tag `connection_delete`) I get tag `elapsed_end_without_start`. (edit: of course, I imply "start events" are present, i.e. are present and are parsed correctly the same way as "end events", and "start event" 's timestamps are earlies than "end events". `unique_id_field` value is also equal for related start and end events).

I've experimented around a bit (my `pipeline.workers` was already `1` since I use aggregate plugin; also tried to set `pipeline.batch.size` to `1` - no difference), but haven't reach any progress.

My main question is: can I use elapsed plugin like that? (when it's configuration is defined in two different branches of logstash config)  
Or, maybe, it is strongly required that elapsed configuration is mentioned only once?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 19, 2021, 1:09pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927/2 "2021-08-19T13:09:54Z")

</div>

> [@alexandrpaliy](#):
>
> can I use elapsed plugin like that? (when it's configuration is defined in two different branches of logstash config)

No, you cannot. The filter [stores state](https://github.com/logstash-plugins/logstash-filter-elapsed/blob/49a94536188acae0209f2dda4e163f68b8515bee/lib/logstash/filters/elapsed.rb#L127) in an instance variable, so the instance in one branch will know nothing about what the instance in the other branch has seen.

---

<div class="post-metadata">

**Author:** ![alexandrpaliy](https://avatars.discourse-cdn.com/v4/letter/a/f0a364/32.png) [@alexandrpaliy](https://discuss.elastic.co/u/alexandrpaliy)\
**Post date:** [August 19, 2021, 1:26pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927/3 "2021-08-19T13:26:56Z")

</div>

Thanks, experimented around and can confirm that "elapsed" works fine if I use it in one branch only.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2021, 1:26pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927/4 "2021-09-16T13:26:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.