# Logstash tag events if it occurs more than certain limit

**URL:** <https://discuss.elastic.co/t/logstash-tag-events-if-it-occurs-more-than-certain-limit/51598>\
**Category:** Logstash\
**Created:** [June 1, 2016, 6:25pm UTC](https://discuss.elastic.co/t/logstash-tag-events-if-it-occurs-more-than-certain-limit/51598 "2016-06-01T18:25:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\
**Post date:** [June 1, 2016, 6:25pm UTC](https://discuss.elastic.co/t/logstash-tag-events-if-it-occurs-more-than-certain-limit/51598/1 "2016-06-01T18:25:31Z")

</div>

The event timestamp is modified initially using  
date {  
match =\> ["date","dd MMM YYYY HH:mm:ss,SSS"]  
locale =\> "es"  
}

Im using throttle, to tag log events with a tag if the events occurs more than 100 times per 10 minutes. Below is the configuration. I was expecting it to be aggregated based on the date field above. However, it is till aggregating based on system time.

throttle {  
before\_count =\> -1  
after\_count =\> 100  
period =\> 600  
key =\> "%{AlertType}%{serviceName}"  
add\_tag =\> "throttled"  
}

In other words, I just wanted to know if there is any way to make throttle aggregate the event counts based on the date/@timestamp field associated with the event rather than aggregating based on time at which the event is received.

As in while testing, if I feed 1 whole days log and the processing gets over in log stash say in 2 minutes, all the events would come within the 10 minute interval, even though the log file is for an entire day.

---

<div class="post-metadata">

**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\
**Post date:** [June 1, 2016, 8:21pm UTC](https://discuss.elastic.co/t/logstash-tag-events-if-it-occurs-more-than-certain-limit/51598/2 "2016-06-01T20:21:51Z")

</div>

From what i see in the throttle code, the expiration for counter is set using :

expiration = now + period

where now=Time.now

It doesn't look into what the date field associated with the event is. So i guess what I need is not possible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/logstash-tag-events-if-it-occurs-more-than-certain-limit/51598/3 "2017-07-06T04:54:59Z")

</div>