# Aggregate data based on some field **URL:** \ **Category:** Logstash\ **Created:** [May 6, 2016, 10:34am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399 "2016-05-06T10:34:33Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Post date:** [May 6, 2016, 10:34am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/1 "2016-05-06T10:34:33Z")
Hi, Grok pattern (?\d{0-6}) %{WORD:loglevel} %{BASE10NUM:amount} I have following set of colums col1=cardNUmber,col2=Info,col3=Amount Data are: 123456 Failed 123.40 123456 Failed 1234 123456 Success 1200 123 Failed 120 Now , i want to aggregate total amount based on particular card number for example: my output for above should be like this 123456 failed (123.40+1234) 123456 success 1200 123 Failed 120 I know we can use aggregate function but still am confusing how should i apply here Please help me out with example Thanks Gaurav ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [May 6, 2016, 2:22pm UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/2 "2016-05-06T14:22:58Z")
You want to aggregate in kibana? You want a sum aggregation on a field your specific field, I think in your case is amount. [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-sum-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-sum-aggregation.html) ---
**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Post date:** [May 7, 2016, 5:29am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/3 "2016-05-07T05:29:18Z")
I want to do aggregation in my logstash.conf file ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 7, 2016, 6:21am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/4 "2016-05-07T06:21:19Z")
I think you'd need to do this via some ruby, there's no plugin that does math like this. ---
**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Post date:** [May 7, 2016, 6:33am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/5 "2016-05-07T06:33:35Z")
Can you give some more pointer or example .cause i am not getting how exactly we will do this ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 7, 2016, 8:30am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/6 "2016-05-07T08:30:18Z")
I think that aggregate plugin could help. But could you give the final json document you expect at the end of logstash ? ---
**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Post date:** [May 9, 2016, 4:50am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/7 "2016-05-09T04:50:40Z")
Input : 123456 Failed 123.40 123456 Failed 1234 123456 Success 1200 123 Failed 120 Output : 123456 failed (123.40+1234) 123456 success 1200 123 Failed 120 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399/8 "2017-07-06T04:58:42Z")