# Aggregate logstash filter config does not work

**URL:** <https://discuss.elastic.co/t/aggregate-logstash-filter-config-does-not-work/89976>\
**Category:** Logstash\
**Created:** [June 19, 2017, 5:34pm UTC](https://discuss.elastic.co/t/aggregate-logstash-filter-config-does-not-work/89976 "2017-06-19T17:34:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pratheek\_k](https://avatars.discourse-cdn.com/v4/letter/p/dc4da7/32.png) [@pratheek\_k](https://discuss.elastic.co/u/pratheek_k)\
**Post date:** [June 19, 2017, 5:34pm UTC](https://discuss.elastic.co/t/aggregate-logstash-filter-config-does-not-work/89976/1 "2017-06-19T17:34:03Z")

</div>

@magnusbaeck  
My goal is to combine events based on pId. Events are not being combined. Please help

Log looks like this:  
June 1st 2017, 11:51:26.992 {id} {pId} ClassName:methodName:99 [DEBUG] - Received request:  
June 1st 2017, 11:51:26.993 {id} {pId} ClassName:methodName:100 [DEBUG] - Id: abbababcajdfbjasndflsdlf  
June 1st 2017, 11:51:26.993 {id} {pId} ClassName:methodName:100 [DEBUG] - unique id: AAAAA  
June 1st 2017, 11:51:26.993 {id} {pId} ClassName:methodName:100 [DEBUG] Total time: 12

Here is my config:  
filter {  
grok{  
match =\> { "message" =\> "%{DATESTAMP:log\_timestamp} %{DATA:id} %{DATA:pId} %{DATA:ClassName} [%{LOGLEVEL:severity}] - %{GREEDYDATA:message}" }  
}  
if [message] =~ /Received request:/ {  
aggregate {  
task\_id =\> "%{pId}"  
code =\> "map['message'] = event['message']"  
map\_action =\> "create"  
}  
}  
else if [message] =~ /Total time:^/ {  
aggregate {  
task\_id =\> "%{pId}"  
code =\> "map['new\_message'] = event['message'];event['new\_message'] = map['new\_message']"  
map\_action =\> "update"  
end\_of\_task =\> true  
timeout =\> 120  
}  
}  
else {  
aggregate {  
task\_id =\> "%{pId}"  
code =\> "map['new\_message'] = event['message'];event['new\_message'] = map['new\_message']"  
map\_action =\> "update"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2017, 5:34pm UTC](https://discuss.elastic.co/t/aggregate-logstash-filter-config-does-not-work/89976/2 "2017-07-17T17:34:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.