# Add data to aggregate from a log line with no specific task\_id

**URL:** <https://discuss.elastic.co/t/add-data-to-aggregate-from-a-log-line-with-no-specific-task-id/117618>\
**Category:** Logstash\
**Created:** [January 30, 2018, 12:39pm UTC](https://discuss.elastic.co/t/add-data-to-aggregate-from-a-log-line-with-no-specific-task-id/117618 "2018-01-30T12:39:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![coda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coda/32/9930_2.png) [@coda](https://discuss.elastic.co/u/coda)\
**Post date:** [January 30, 2018, 12:39pm UTC](https://discuss.elastic.co/t/add-data-to-aggregate-from-a-log-line-with-no-specific-task-id/117618/1 "2018-01-30T12:39:06Z")

</div>

Excuse me everyone,

Given the following events:

```auto
event1 = {
  "queueid" => "ABC1234",
  "process" => "qmgr",
  "from" => "sender@domain.com"
}

event2 = {
  "queue_id" => "ABC1234",
  "process" => "smtp",
  "to" => "recipient@domain.com",
  "messageid" => "1517305644.29809.1@Organization"
}

event3 = {
  "process" => "spamd",
  "messageid" => "1517305644.29809.1@Organization",
  "spam_result" => "Yes"
}

```

Would it be possible to aggregate them into something like this?:

```auto
finalEvent = {
  "queueid" => "ABC1234",
  "from" => "sender@domain.com",
  "to" => "recipient@domain.com",
  "messageid" => "1517305644.29809.1@Organization",
  "spam_result" => "Yes"
}

```

I'm being able to aggregate the first two events by using 'queueid' as task\_id, but I'm not sure if it would be possible to add info from event3 to it based on it's 'messageid' field.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2018, 12:39pm UTC](https://discuss.elastic.co/t/add-data-to-aggregate-from-a-log-line-with-no-specific-task-id/117618/2 "2018-02-27T12:39:22Z")

</div>

Closed on February 27, 2018, 12:39pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.