help with the codec option aggregate plugin about logstash-filter-aggregate

[untergeek]

But I need help and I don't know where can I go.

The appropriate place for usage questions is https://discuss.elastic.co/c/logstash

Feel free to copy and paste the question there.

[simpleuser99]

I post the question https://discuss.elastic.co/t/specific-grok-filter-for-multi-line-postgresql-log/56286
but I haven't help

[simpleuser99]

After much effort, I made such a configuration:

filter {
grok {
match => [ "message", "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:logsource} %{SYSLOGPROG}: [%{INT:line}-%{INT:part_of_line}] %{GREEDYDATA:ostatok}" ]
}

    aggregate {
            task_id => "%{line}"
             code =>  "map['full_message'] ||= '' ; map['full_message'] += event['ostatok'] ; event['full_message'] ||= '' ; event['full_message'] = map['full_message']"
           }

}

But I have next event on elasticsearch:

event 1: ...[137-1]...
event 2: ...[137-1] and [137-2]...
event 3: ...[2953-1]...
event 4: ...[3779-1]...
event 5: ...[138-1]...
event 6: ...[138-1] and [138-2]...
event 7: ...[3780-1]...
event 8: ...[139-1]...
event 9: ...[2954-1]...
event 10: ...[2954-1] and [2954-2]...

How I can clean my events from event 1: ...[137-1]..., event 5: ...[138-1]..., event 7: ...[2954-1]... ?