# RSpec: Testing Aggregate Filters

**URL:** <https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345>\
**Category:** Logstash\
**Created:** [October 21, 2021, 6:02pm UTC](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345 "2021-10-21T18:02:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![UXabre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/uxabre/32/96204_2.png) [@UXabre](https://discuss.elastic.co/u/UXabre)\
**Post date:** [October 21, 2021, 6:02pm UTC](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345/1 "2021-10-21T18:02:56Z")

</div>

I'm trying to unittest a filter that utilizes aggregate filter.  
In my sample, I'm dropping all messages and wait for the timeout to occur instead. I'd like to retrieve this async message somehow and verify if the contents.

**Sample Pipeline config:**

```auto
filter {
  grok {
      match => ["message", "%{LOGLEVEL:loglevel} - %{NOTSPACE:user_id} - %{GREEDYDATA:msg_text}"]
    }

    aggregate {
        task_id => "%{user_id}"
        code => "map['clicks'] ||= 0; map['clicks'] += 1;"
        push_map_as_event_on_timeout => true
        timeout_task_id_field => "user_id"
        push_previous_map_as_event => true
        timeout => 1
        timeout_tags => ['_aggregatetimeout']
        timeout_code => "event.set('several_clicks', event.get('clicks') > 1)"
    }

    drop {}
}

```

**Sample test**

```auto
message1 = 'INFO - 12345 - Clicked One'
        message2 = 'INFO - 12345 - Clicked Two'
        message3 = 'INFO - 12345 - Clicked Three'
        sample([message1, message2, message3], :validation_source => :queue) do
       
          # Check the ouput event/message properties or in my case...try to figure out how to get these message
          sleep(5)

          puts(results.last)
          puts(pipeline.filter_queue_client.read_batch)

```

Any help is appreciated (probably my lack of good ruby knowledge isn't helping me as well...)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2021, 6:03pm UTC](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345/2 "2021-11-18T18:03:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.