Problems with multiple worker threads about logstash-filter-aggregate

[fbaligand]

Hi @erik-stephens,

When you use multiple workers (so multiple threads in parallel), you have no guarantee on the order of arrival of events.
So aggregate filter could process firstable event "2" and then event "1".
That's what happens in your second result document.
And in your third result document, the "finished" event is processed before "start" event so you get only "finished" as result "message" field (no aggregation is done because "map_action=update" condition is not met).

So, because aggregate filter is dependant from order of arrival of events, you have to use only one worker to have a nice behaviour.

A tip that I can give to you to have multiple events processed at the same time (for performance needs) : you could start several logstash instances, each instance will read one input (on file, one tcp port, ...). Like that each instance has one worker ; but globally, you have as many workers as logstash instances.

[erik-stephens]

I saw the mutex code and thought that was to support multiple worker threads. Do you or anyone else know what that is for? I want to make sure I understand that when working on #14. Thanks.

[fbaligand]

Hi @erik-stephens,

Actually, I am the creator of this plugin, so I know very well each line of code ;)
Globally (not just for this plugin), Thread-safety is something important to me.
So, from the beginning, I make the plugin code thread-safe.
It could be really useful if you can be sure that for one task id, all related events happen in the right order into aggregate plugin.
But presently, it is not the case.

There are some plans in logstash roadmap to support multiple pipelines in one logstash instance.
This could be a start point for that.

I would really enjoy, if I could specify one worker thread per tag, given that tag is positioned by input. Using that, I could really support multiple workers.

But today, technically, code is thread-safe (it won't raise an exception with multiple threads), but functionally, it is not thread-safe.

[erik-stephens]

Thanks for the explanation. I think I understand now.