config

  metrics {
    tags         => [ "apache-accesslog" ]
    meter        => [ "http.%{appenv}.status.%{status}" ]
    add_tag      => [ "apache-metrics" ]
    past_seconds => 9
  }

metrics filter diff

--- a/lib/logstash/filters/metrics.rb
+++ b/lib/logstash/filters/metrics.rb
@@ -101,6 +101,10 @@ class LogStash::Filters::Metrics < LogStash::Filters::Base
   # syntax: timer => [ "name of metric", "%{time_value}" ]
   config :timer, :validate => :hash, :default => {}
 
+  # skip events that have @timestamp older than @past_seconds, 0 means allways count
+  # this is usefull then logstash was down/restarted and metrics will get skewed by too many old events
+  config :past_seconds, :validate => :number, :default => 0
+
   def register
     require "metriks"
     require "socket"
@@ -112,6 +116,14 @@ class LogStash::Filters::Metrics < LogStash::Filters::Base
   def filter(event)
     return unless filter?(event)
 
+    #@logger.warn("11111", :timestamp => event.timestamp.to_s)
+    #@logger.warn("22222", :current_timestamp => Time.now)
+    #@logger.warn("33333", :event_timestamp => event.ruby_timestamp)
+    @logger.warn("44444", :past_seconds => @past_seconds)
+    #if @past_seconds > 0
+      #return if Time.now - event.ruby_timestamp > @past_seconds
+    #nd
+
     @meter.each do |m|
       @metric_meters[event.sprintf(m)].mark
     end

output

4444 {:past_seconds=>0, :level=>:warn}