Throttle mix counters

Elastic Stack Logstash
#1

Hi,

I use throttle to count, send an email when it reach the number of logs.
The problem is that i use the key %{host} and it counts all messages, because all messages came with a field "host".
I thought it counted it isolated:

  • host1 : 1+1+1+1
    -host2: 1+1+1+1

How can i get that behaviour?

Thank you

#2

I'm sure my target is done by someone...i can't believe no one knows how to set it up in the right way.

Thanks

#3

I'm still with this issue.
PLease someone knows how to fix that?

Thanks in advance

#4