# Aggregate fields from different event

**URL:** https://discuss.elastic.co/t/aggregate-fields-from-different-event/44078
**Category:** Logstash
**Created:** [March 10, 2016, 8:04pm UTC](https://discuss.elastic.co/t/aggregate-fields-from-different-event/44078 "2016-03-10T20:04:13Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![rbkumar88](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@rbkumar88](https://discuss.elastic.co/u/rbkumar88)
#### Post date: [March 10, 2016, 8:04pm UTC](https://discuss.elastic.co/t/aggregate-fields-from-different-event/44078/1 "2016-03-10T20:04:13Z")

</div>

Hi,

Please help me setting the filter plugin for the following scenario.  
Say I have the following scenario

INFO - 12345 - TASK\_START - start  
INFO - 12345 - SQL - sqlQuery1 - 12  
INFO - 12345 - SQL - sqlQuery2 - 34  
INFO - 12345 - SQL - sqlQuery3 - 44  
INFO - 12345 - TASK\_END - end

If I am aggregating using taskid (12345), there are two things, I want to do.  
One is just existence check whether sqlQuery1 happened or not  
Other is basically collect all the fields, so that my final single document looks like.

(Assumption sqlQuery2 and sqlQuery3 always happen/present)

task id 12345  
sqlQuery2Time 34  
sqlQuery3Time 44  
sqlQuery1PresentOrNot (boolean) true  
sqlQuery1Time 12 (optional field )

Is Aggregate filter plugin the right one for my above scenario or any other plugins can help in as well.

Regards  
Bharath

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 12, 2016, 9:53am UTC](https://discuss.elastic.co/t/aggregate-fields-from-different-event/44078/2 "2016-03-12T09:53:50Z")

</div>

Aggregate is probably the one!

---

<div class="post-metadata">

### Author: ![rbkumar88](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@rbkumar88](https://discuss.elastic.co/u/rbkumar88)
#### Post date: [April 5, 2016, 6:54pm UTC](https://discuss.elastic.co/t/aggregate-fields-from-different-event/44078/3 "2016-04-05T18:54:54Z")

</div>

Hi,

Can aggregate filter help me in collecting different fields from intermediate lines/events and have it in the final aggregated event. I know it is mainly for simply adding up time based fields.

Thanks  
Bharath

---

<div class="post-metadata">

### Author: ![rbkumar88](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@rbkumar88](https://discuss.elastic.co/u/rbkumar88)
#### Post date: [April 5, 2016, 7:07pm UTC](https://discuss.elastic.co/t/aggregate-fields-from-different-event/44078/4 "2016-04-05T19:07:48Z")

</div>

Hi,

I just went over the Use cases for this plugin

--extract error information in any task log line, and push it in final task event (to get a final document with all error information if any)

Can someone give me an example of how the "code" option should look like for the above scenario?

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/aggregate-fields-from-different-event/44078/5 "2017-07-06T05:03:45Z")

</div>