# Adding fields to next line using Logstash Aggregate
**URL:** https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684
**Category:** Logstash
**Created:** [November 20, 2019, 11:32am UTC](https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684 "2019-11-20T11:32:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@rwcanand](https://discuss.elastic.co/u/rwcanand)
#### Post date: [November 20, 2019, 11:32am UTC](https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684/1 "2019-11-20T11:32:37Z")
Hi,
- I'm trying to implement a use case where I want to add an existing field on a line to the next line.
- I tried to implement this using `aggregate` with `pipeline.workers` set to **1**.
- The sample Log file is as below
```auto
Data1 HEADER1 Key1 - Val1
Data2 Key2 - Val2
Data3 Key3 - Val3
Data4 HEADER2 Key4 - Val4
Data5 Key5 - Val5
Data6 Key6 - Val6
```
- The expected output is (only showing some lines)
```json
{
"header" => "HEADER1",
"key" => "Key1",
"val" => "Val1",
"task_id" => "all",
"data" => "Data1",
"@timestamp" => 2019-11-20T11:16:54.050Z
}
{
"header" => "HEADER1",
"key" => "Key2",
"val" => "Val2",
"task_id" => "all",
"data" => "Data2",
"@timestamp" => 2019-11-20T11:16:54.051Z
}
```
- i.e. the `header` field from 1st line got added as a new field for the second line and so on.
- But for some reason all the lines with `header` field are getting processed before the lines without it, ultimately resulting in a output that looks like this
```json
{
"header" => "HEADER1",
"key" => "Key1",
"val" => "Val1",
"task_id" => "all",
"data" => "Data1",
"@timestamp" => 2019-11-20T11:16:54.050Z
}
{
"header" => "HEADER2",
"key" => "Key4",
"val" => "Val4",
"task_id" => "all",
"data" => "Data4",
"@timestamp" => 2019-11-20T11:16:54.051Z
}
{
"header" => "HEADER2",
"key" => "Key2",
"val" => "Val2",
"task_id" => "all",
"data" => "Data2",
"@timestamp" => 2019-11-20T11:16:54.051Z
}
{
"header" => "HEADER2",
"key" => "Key3",
"val" => "Val3",
"task_id" => "all",
"data" => "Data3",
"@timestamp" => 2019-11-20T11:16:54.051Z
}
{
"header" => "HEADER2",
"key" => "Key5",
"val" => "Val5",
"task_id" => "all",
"data" => "Data5",
"@timestamp" => 2019-11-20T11:16:54.051Z
}
{
"header" => "HEADER2",
"key" => "Key6",
"val" => "Val6",
"task_id" => "all",
"data" => "Data6",
"@timestamp" => 2019-11-20T11:16:54.051Z
}
```
- Here is my current Logstash Config
```auto
input {
beats {
port => 5044
}
}
filter {
grok {
match => {
"message" => ["%{WORD:data}\s%{WORD:header}\s%{WORD:key} - %{WORD:val}", "%{WORD:data}\s%{WORD:key} - %{WORD:val}"]
}
}
mutate {
add_field => {"task_id" => "all"}
}
if [header] {
aggregate {
task_id => "%{task_id}"
code => "map['header'] = event.get('header')"
}
} else {
aggregate {
task_id => "%{task_id}"
code => "event.set('header', map['header'])"
map_action => "update"
timeout => 0
}
}
}
output {
stdout {
codec => rubydebug
}
}
```
- Filebeat config
```auto
filebeat.inputs:
- type: log
paths:
- "/home/user/downloads/logs/test.log"
output.logstash:
hosts: "localhost:5044"
```
Appreciate any help on this.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 20, 2019, 2:20pm UTC](https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684/2 "2019-11-20T14:20:46Z")
Have you set pipeline.java\_execution: false? If not, events [get re-ordered](https://github.com/elastic/logstash/issues/10938).
---
### Author:  [@rwcanand](https://discuss.elastic.co/u/rwcanand)
#### Post date: [November 21, 2019, 1:38pm UTC](https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684/3 "2019-11-21T13:38:57Z")
Thanks @Badger that resolved it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 19, 2019, 1:39pm UTC](https://discuss.elastic.co/t/adding-fields-to-next-line-using-logstash-aggregate/208684/4 "2019-12-19T13:39:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.