# Aggregate all event messages
**URL:** https://discuss.elastic.co/t/aggregate-all-event-messages/74866
**Category:** Logstash
**Created:** [February 13, 2017, 11:27am UTC](https://discuss.elastic.co/t/aggregate-all-event-messages/74866 "2017-02-13T11:27:36Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ademicky](https://discuss.elastic.co/u/ademicky)
#### Post date: [February 13, 2017, 11:27am UTC](https://discuss.elastic.co/t/aggregate-all-event-messages/74866/1 "2017-02-13T11:27:36Z")
Hi Everyone,
I am sorry if I'm posting this in the wrong place. I have an issue with logstash aggregate filter which has been on going for 2 weeks now.
I am a java developer, so dont understand much of ruby. The challenge I am facing is, I get log alerts every often, so I want all log within 2mins to be aggregated as a single event, with my current configuration I only receive a single alert every 2mins, if more than one alert occur only one is sent. I would let all alerts aggregated as one event. Below is the snippet of the filter Im using. Please I need some help, thank you .
filter {
if "Alert" in [message] {
aggregate {
task\_id =\> "%{source}"
code =\> "map['alerts'] = event.get('message')"
map\_action =\> "create\_or\_update"
push\_map\_as\_event\_on\_timeout =\> true
timeout =\> 120
timeout\_tags =\> ['aggregated']
}
if "aggregated" not in [tags] {
drop{}
}
} else {
drop{}
}
}
---
### Author:  [@ademicky](https://discuss.elastic.co/u/ademicky)
#### Post date: [February 13, 2017, 4:10pm UTC](https://discuss.elastic.co/t/aggregate-all-event-messages/74866/2 "2017-02-13T16:10:42Z")
I figured it out. Again I apologise if im posting in the wrong section, I am new
Here is the solution :
filter {
if "Alert" in [message] {
aggregate {
task\_id =\> "%{source}"
code =\> "map['alerts'] ||=' '; map['alerts'] +=%{\n}+ event.get('message')"
map\_action =\> "create\_or\_update"
push\_map\_as\_event\_on\_timeout =\> true
timeout =\> 120
timeout\_tags =\> ['aggregated']
}
if "aggregated" not in [tags] {
drop{}
}
} else {
drop{}
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 13, 2017, 4:10pm UTC](https://discuss.elastic.co/t/aggregate-all-event-messages/74866/3 "2017-03-13T16:10:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.