# Aggregate filter that stores the value from previous record

**URL:** https://discuss.elastic.co/t/aggregate-filter-that-stores-the-value-from-previous-record/90859
**Category:** Logstash
**Created:** [June 26, 2017, 5:07pm UTC](https://discuss.elastic.co/t/aggregate-filter-that-stores-the-value-from-previous-record/90859 "2017-06-26T17:07:21Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Tejas\_Ghutukade](https://avatars.discourse-cdn.com/v4/letter/t/ba9def/32.png) [@Tejas\_Ghutukade](https://discuss.elastic.co/u/Tejas_Ghutukade)
#### Post date: [June 26, 2017, 5:07pm UTC](https://discuss.elastic.co/t/aggregate-filter-that-stores-the-value-from-previous-record/90859/1 "2017-06-26T17:07:21Z")

</div>

I am trying to write aggregate filter in logstash which stores the value of previous record into a field. Here's my aggregate filter:

```
aggregate {
    task_id => "%{TRANSACTIONIDGLOBAL}"
    code => "   
    map['tr_start'] ||= event.get('starttime')
    map['tr_end'] ||= event.get('endtime')
    event.set('cc' ,map['tr_end'])
    map['tr_start'] << event.get('starttime')
    map['tr_end'] << event.get('endtime')       
    "
    map_action => "create_or_update" 
}

```

but in the output the field "cc" consist the value of the same record and not the previous record

```
Output
starttime endtime cc
1,493,668,033 1,493,668,039 1,493,668,039
1,493,668,037 1,493,668,037 1,493,668,037
1,493,668,358 1,493,668,358 1,493,668,358

```

But the Output i want is

```
Output
starttime endtime cc
1,493,668,033 **1,493,668,039** 1,493,668,039
1,493,668,037 *1,493,668,037* **1,493,668,039**
1,493,668,358 1,493,668,358 *1,493,668,037*

```

any help will be appreciated. Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 24, 2017, 5:07pm UTC](https://discuss.elastic.co/t/aggregate-filter-that-stores-the-value-from-previous-record/90859/2 "2017-07-24T17:07:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.