# Throttle filter picking up old instead of new value

**URL:** https://discuss.elastic.co/t/throttle-filter-picking-up-old-instead-of-new-value/114351
**Category:** Logstash
**Created:** [January 6, 2018, 2:12am UTC](https://discuss.elastic.co/t/throttle-filter-picking-up-old-instead-of-new-value/114351 "2018-01-06T02:12:52Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [January 6, 2018, 2:12am UTC](https://discuss.elastic.co/t/throttle-filter-picking-up-old-instead-of-new-value/114351/1 "2018-01-06T02:12:52Z")

</div>

Hi,

I'm struggling a bit with the throttle filter. After the period expires I expect the throttle filter to save the first new event, but instead its saving the last old event.

```auto
input {
  file {
    path => "/home/test/Desktop/test/kvh/test.txt"
    sincedb_path => "/dev/null"
    start_position => "beginning"
}
}

filter {

  mutate {
    gsub => [
      "message", "[+$>*]", ""
    ]
  }

	grok { 
		match => { "message" => [ 
				"%{GREEDYDATA:TIME} GPRMC,%{GREEDYDATA:GPS}"
					] }

		tag_on_failure => [grok_failure"] 
	     }

if "grok_failure" in [tags] {
  drop { }
}

mutate {
  add_field => {
    "GPRMC" => "%{TIME} GPRMC,%{GPS}"
  }
  remove_field => ["TIME", "GPS", "path", "@version", "host", "message"]
}

  throttle {
    before_count => -1
    after_count => 1
    period => 60
    max_age => 180
  	key => "GPRMC"
   	add_tag => "throttled"
  }
  if "throttled" in [tags] {
    drop { }
  }
}
```

Ignore the grok filter for a moment and lets say me input is error1, error2 etc.

What I see happening is this:

- I have a empty file and start logstash.
- I copy error1 to the file. Error1 appears in stdout, this is correct.
- I paste error1 again within 60 seconds, nothing appears, I paste error2 within one minute, nothing appears. This is correct.
- 60+ seconds after I pasted the first error1 I paste error3 into the file. Error2 appears in the output.

I don't believe this is correct and instead want the first value after throttle period has passed to be logged and not the last value from the previous period.

What am I doing wrong? I tried changing beginning to end and the sincedb path in the file input just in case but that doesn't appear to be the issue. As far as I can tell the throttle filter is correct.

---

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [January 6, 2018, 4:37am UTC](https://discuss.elastic.co/t/throttle-filter-picking-up-old-instead-of-new-value/114351/2 "2018-01-06T04:37:47Z")

</div>

I've made a test script that generates random data for testing. I've noticed that besides the issue described above the 60 second period is also not always respected and in some instances events get through even though 60 seconds hasn't passed yet.

stdout

```auto
         "GPRMC" => "2018-01-06 13:23:45 GPRMC,073126.000,C,3444.4604,C,13521.2644,C,0.15,116.79,261217,,,D64",
    "@timestamp" => 2018-01-06T04:23:45.890Z
}
{
         "GPRMC" => "2018-01-06 13:24:42 GPRMC,073126.000,C,3444.4604,C,13521.2644,C,0.11,116.79,261217,,,D64",
    "@timestamp" => 2018-01-06T04:24:43.021Z
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 3, 2018, 4:38am UTC](https://discuss.elastic.co/t/throttle-filter-picking-up-old-instead-of-new-value/114351/3 "2018-02-03T04:38:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.