You can maintain state in an aggregate filter. This post has an example of collecting data in the map and then generating an event when some condition is met.
It is not a scaleable solution and is really not a use case logstash was designed for.
1 Like