# Throttle Moving Window

**URL:** <https://discuss.elastic.co/t/throttle-moving-window/93824>\
**Category:** Logstash\
**Created:** [July 19, 2017, 6:12pm UTC](https://discuss.elastic.co/t/throttle-moving-window/93824 "2017-07-19T18:12:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![brian-spot](https://avatars.discourse-cdn.com/v4/letter/b/ee7513/32.png) [@brian-spot](https://discuss.elastic.co/u/brian-spot)\
**Post date:** [July 19, 2017, 6:12pm UTC](https://discuss.elastic.co/t/throttle-moving-window/93824/1 "2017-07-19T18:12:46Z")

</div>

Is it possible to have a moving window to monitor events through throttle filter or something similar?

Ex.  
If I run this throttle filter:

```
if [event] == "SomeEvent" {
  throttle {
    after_count => 2
    period => 10
    key => "throttle_key"
    add_tag => "Alert"
  }
}

```

If I have messages that would match the event with the following timestamps

1. "timestamp":"2017-07-10T18:25:10.000000"
2. "timestamp":"2017-07-10T18:25:13.000000"
3. "timestamp":"2017-07-10T18:25:21.000000"
4. "timestamp":"2017-07-10T18:25:22.000000"

None of the messages will get the tag, even though there are 3 messages in a 10 second period (2, 3, and 4). Is there anything that will catch that?

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [July 21, 2017, 4:00pm UTC](https://discuss.elastic.co/t/throttle-moving-window/93824/2 "2017-07-21T16:00:24Z")

</div>

Hmmm, that should work. Is it tagging any events at all?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2017, 4:00pm UTC](https://discuss.elastic.co/t/throttle-moving-window/93824/3 "2017-08-18T16:00:35Z")

</div>

Closed on August 18, 2017, 4:00pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.