# Wait until there is a specific message

**URL:** <https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600>\
**Category:** Logstash\
**Created:** [March 30, 2017, 6:53am UTC](https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600 "2017-03-30T06:53:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![yanivo](https://avatars.discourse-cdn.com/v4/letter/y/b5a626/32.png) [@yanivo](https://discuss.elastic.co/u/yanivo)\
**Post date:** [March 30, 2017, 6:53am UTC](https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600/1 "2017-03-30T06:53:10Z")

</div>

Hi,

let's say I have the following lines in my logs:

```
Message: msisdn: 111111111
Message: msisdn: 222222222
Answer: msisdn: 111111111
Answer: msisdn: 222222222

```

Now, whenever I get a **Message** , I'd like to wait for X seconds (and, of course, continue process other lines). If within this time period I get the matching **Answer** (i.e. with the same msisdn), mark it as OK, else mark it as ERROR.

How can I do that?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 30, 2017, 7:14am UTC](https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600/2 "2017-03-30T07:14:56Z")

</div>

I'm pretty sure you need to write a custom filter plugin for this.

---

<div class="post-metadata">

**Author:** ![yanivo](https://avatars.discourse-cdn.com/v4/letter/y/b5a626/32.png) [@yanivo](https://discuss.elastic.co/u/yanivo)\
**Post date:** [March 30, 2017, 7:37am UTC](https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600/3 "2017-03-30T07:37:22Z")

</div>

I really hoped that I won't have to write plugins but thanks 😉

Maybe I should save the data in elastcsearch and than periodically search for Messages without Answers. Do you think it's a good idea?

Thanks again

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 30, 2017, 7:45am UTC](https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600/4 "2017-03-30T07:45:27Z")

</div>

> Maybe I should save the data in elastcsearch and than periodically search for Messages without Answers. Do you think it's a good idea?

Sure, that should work but I don't think there's a way to ask such a query efficiently so depending on the amount of data you may have to use clever caching to avoid flooding the ES server with queries.

---

<div class="post-metadata">

**Author:** ![yanivo](https://avatars.discourse-cdn.com/v4/letter/y/b5a626/32.png) [@yanivo](https://discuss.elastic.co/u/yanivo)\
**Post date:** [March 30, 2017, 7:50am UTC](https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600/5 "2017-03-30T07:50:54Z")

</div>

Oh, I think I found something in the documentation.  
The aggregate filter with "push\_map\_as\_event\_on\_timeout".

It's on this page (Example #3):  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2017, 7:50am UTC](https://discuss.elastic.co/t/wait-until-there-is-a-specific-message/80600/6 "2017-04-27T07:50:56Z")

</div>

Closed on April 27, 2017, 7:50am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.