Logstash merge events


I want to merge two events. First one has few fields, which I will merge with second event using aggregate plugin. But at times, first event comes little late and second event has null values for those fields. I want aggregate-update(which is part of second update) to wait till some one create the aggregate id(which is part of first event). By any chance is this possible?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.