# When in,filter,out not the same event

**URL:** <https://discuss.elastic.co/t/when-in-filter-out-not-the-same-event/151988>\
**Category:** Logstash\
**Created:** [October 11, 2018, 6:25am UTC](https://discuss.elastic.co/t/when-in-filter-out-not-the-same-event/151988 "2018-10-11T06:25:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shwesinhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwesinhan/32/78663_2.png) [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\
**Post date:** [October 11, 2018, 6:25am UTC](https://discuss.elastic.co/t/when-in-filter-out-not-the-same-event/151988/1 "2018-10-11T06:25:55Z")

</div>

hi team,

i add a couple of elapsed filters in my logstash pipeline it works properly.  
but i'm wonder why in,filter and out events not same

eg:  
when i **start** logstash service, in, filter and output events show **same**  
a few hour laters it shows

> {  
> "host" : "logstash-server",  
> "version" : "6.1.1",  
> "http\_address" : "127.0.0.1:9600",  
> "id" : "b930b316-154b-4e4a-b963-b9d91d5be3ra",  
> "name" : "logstash-server",  
> "events" : {  
> "in" : 4964,  
> "filtered" : 4964,  
> "out" : 4970,  
> "duration\_in\_millis" : 30431,  
> "queue\_push\_duration\_in\_millis" : 265  
> }  
> }

and again a few min later it shows

> {  
> "host" : "logstash-server",  
> "version" : "6.1.1",  
> "http\_address" : "127.0.0.1:9600",  
> "id" : "b930b316-154b-4e4a-b963-b9d91d5be3ra",  
> "name" : "logstash-server",  
> "events" : {  
> "in" : 5310,  
> "filtered" : 5310,  
> "out" : 5318,  
> "duration\_in\_millis" : 33603,  
> "queue\_push\_duration\_in\_millis" : 279  
> }  
> }

and check again

> {  
> "host" : "logstash-server",  
> "version" : "6.1.1",  
> "http\_address" : "127.0.0.1:9600",  
> "id" : "b930b316-154b-4e4a-b963-b9d91d5be3ra",  
> "name" : "logstash-server",  
> "events" : {  
> "in" : 8190,  
> "filtered" : 8190,  
> "out" : 8213,  
> "duration\_in\_millis" : 61985,  
> "queue\_push\_duration\_in\_millis" : 754  
> }  
> }

i don't use `add new_event_on_match = true` in elapsed filter  
why `out` event becomes greater than `in` and `filter` later?  
could somebody explain me??

i appreciate that! 🙂

---

<div class="post-metadata">

**Author:** ![shwesinhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwesinhan/32/78663_2.png) [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\
**Post date:** [October 11, 2018, 2:20pm UTC](https://discuss.elastic.co/t/when-in-filter-out-not-the-same-event/151988/2 "2018-10-11T14:20:01Z")

</div>

oh i found myself  
it's because "expired event" is generated that makes greater count to `out` event. 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2018, 2:20pm UTC](https://discuss.elastic.co/t/when-in-filter-out-not-the-same-event/151988/3 "2018-11-08T14:20:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.