aggregation logstash config

aggregation logstash config

input {
  beats {
    port => 5044
  }
  file {
    path => "/vagrant/logs-8/test.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}

filter {

  grok {
    match => { "message" => '^%{IPORHOST:clientip} %{HTTPDUSER:ident} %{DATA:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}$' }
    remove_field => [ "message" ]
  }

  mutate {
      gsub => ["agent", "\"", ""]
  }

  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    target => "iso_timestamp"
  }


  aggregate {
      task_id => "%{clientip}%{agent}%{request}"
      code => "
          map['clicks'] ||= 0
          map['clicks'] += 1
          map['iso_timestamps'] ||= []
          map['iso_timestamps'] << {'iso_timestamp' => event.get('iso_timestamp')}
          event.cancel()
          "

      timeout_task_id_field => "task_id"
      timeout_timestamp_field => "iso_timestamp"
      timeout => 30
      push_map_as_event_on_timeout => true
      timeout_code => "
                        event.set('double_click', event.get('clicks') > 1)
                      "
  }


}


output {
    mongodb {
       uri => ["mongodb://localhost"]
       database => "reporting"
       collection => "aggregate_test"
       isodate => true
    }
}

Altered the config to remove event.set('iso_timestamps', event.get('iso_timestamps'))