# Aggegation of log lines
**URL:** https://discuss.elastic.co/t/aggegation-of-log-lines/128166
**Category:** Logstash
**Created:** [April 16, 2018, 10:15am UTC](https://discuss.elastic.co/t/aggegation-of-log-lines/128166 "2018-04-16T10:15:16Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Ganesha\_Venkanna](https://discuss.elastic.co/u/Ganesha_Venkanna)
#### Post date: [April 16, 2018, 10:15am UTC](https://discuss.elastic.co/t/aggegation-of-log-lines/128166/1 "2018-04-16T10:15:16Z")
I would like to aggregate the below 3 lines (everything same except timestamp)
```
04/13/2018 19:31:20 [ACPServerThread_226] VERBOSE SERVER - ::ACPSCConnectionResponder::SiteController Connection Accepted for SiteControllerIP= 172.168.1.134 , SiteControllerId= 1
04/13/2018 19:32:20 [ACPServerThread_226] VERBOSE SERVER - ::ACPSCConnectionResponder::SiteController Connection Accepted for SiteControllerIP= 172.168.1.134 , SiteControllerId= 1
04/13/2018 19:35:20 [ACPServerThread_226] VERBOSE SERVER - ::ACPSCConnectionResponder::SiteController Connection Accepted for SiteControllerIP= 172.168.1.134 , SiteControllerId= 1
```
as(message with the count)
`04/13/2018 19:35:20 [ACPServerThread_226] VERBOSE SERVER - ::ACPSCConnectionResponder::SiteController Connection Accepted for SiteControllerIP= 172.168.1.134 , SiteControllerId= 1`,count=3
Below is my configuration which is not working.
```
input {
file {
path => "C:/poc/*.log"
start_position => "beginning"
codec => multiline {
patterns_dir => ["./patterns"]
pattern => "^%{PANACES_DATE}"
negate => true
what => previous
}
}
}
filter {
if ([message] =~ "SiteController Connection Accepted for SiteControllerIP="){
grok {
patterns_dir => ["./patterns"]
match => { "message" => "%{PANACES_DATE:log_date}%{SPACE}\[%{GREEDYDATA:threadname}\]%{SPACE}%{WORD:module}%{SPACE}%{WORD:submodule}%{SPACE}[\-]%{SPACE}::%{WORD:classname}::%{DATA:log_message}%{SPACE}%{IP:siteControllerIP}%{SPACE}[\,]%{SPACE}%{WORD:siteControllerIDKey}[\=]%{SPACE}%{NUMBER:siteControllerID}" }
}
aggregate {
task_id => "%{threadname}"
code => "map['count'] ||= 0 ;
map['count'] +=1;
map['message'] = event.get('message');"
push_map_as_event_on_timeout => true
timeout_task_id_field => "threadname"
timeout => 60
}
}
else{
drop { }
}
date {
match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "agentlogs21"
}
stdout { codec => json}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2018, 10:15am UTC](https://discuss.elastic.co/t/aggegation-of-log-lines/128166/2 "2018-05-14T10:15:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.