The event timestamp is modified initially using date { match => [ "date","dd MMM YYYY HH:mm:ss,SSS"] locale => "es" } Im using throttle, to tag log events with a tag if the events occurs more than 100 times per 10 minutes. Below is the configuration. I was expecting it to be aggregated based on…

Logstash tag events if it occurs more than certain limit

Topic		Replies	Views
Logstash Filter: How To Add Tag For “If X Event Happens More Than Y Times In Z Seconds” Logstash	3	910	July 6, 2017
Pipeline throttle not working properly Logstash	1	459	March 5, 2020
How to use throttle filter to add tag to only one record Logstash	1	258	July 30, 2021
Throttle by tag Logstash	1	312	February 9, 2017
Reducing the number of Alerts Logstash	3	568	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash tag events if it occurs more than certain limit

Related topics