Add data to aggregate from a log line with no specific task_id

Excuse me everyone,

Given the following events:

event1 = {
  "queueid" => "ABC1234",
  "process" => "qmgr",
  "from" => "sender@domain.com"
}

event2 = {
  "queue_id" => "ABC1234",
  "process" => "smtp",
  "to" => "recipient@domain.com",
  "messageid" => "1517305644.29809.1@Organization"
}

event3 = {
  "process" => "spamd",
  "messageid" => "1517305644.29809.1@Organization",
  "spam_result" => "Yes"
}

Would it be possible to aggregate them into something like this?:

finalEvent = {
  "queueid" => "ABC1234",
  "from" => "sender@domain.com",
  "to" => "recipient@domain.com",
  "messageid" => "1517305644.29809.1@Organization",
  "spam_result" => "Yes"
}

I'm being able to aggregate the first two events by using 'queueid' as task_id, but I'm not sure if it would be possible to add info from event3 to it based on it's 'messageid' field.

Thanks in advance!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.