Problem using timeout_timestamp_field in the aggregate filter

Elastic Stack Logstash
1

Hi,
I'm trying to use the aggregate filter with a timeout based on a timestamp in the event.

In the filter, I have set
timeout_timestamp_field => "start"

When I run logstash, I get the error
undefined method 'time' for 1517443429.255:Float
at /lib/logstash/filters/aggregate.rb:438:in 'reference_timestamp'
That method is very short:
def reference_timestamp(event)
return (@timeout_timestamp_field) ? event.get(@timeout_timestamp_field).time : Time.now
end

1517443429.255 must be the value of start in the first event.

2

That's right. A float does not have a method called float. A Logstash::TimeStamp does. Try

date { match => [ "start", UNIX ] target => "start" }

before the aggreegate.

3

That worked! Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.