# Aggregate messages with different patterns
**URL:** https://discuss.elastic.co/t/aggregate-messages-with-different-patterns/114411
**Category:** Logstash
**Created:** [January 7, 2018, 10:56am UTC](https://discuss.elastic.co/t/aggregate-messages-with-different-patterns/114411 "2018-01-07T10:56:14Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@dooz](https://discuss.elastic.co/u/dooz)
#### Post date: [January 7, 2018, 10:56am UTC](https://discuss.elastic.co/t/aggregate-messages-with-different-patterns/114411/1 "2018-01-07T10:56:14Z")
Hello,
An application we manage generates logs with different patterns.
One event generates between 2 and 4 messages, which have the same event\_id in the lig message (in the below example: "event\_id\_1"
Each message with the same event\_id has a code\_number and a sub\_code\_number. Depending of the couple code\_number/sub\_code\_number, the message pattern is different.
For example, I have the following log messages associated to "event\_id\_1"
log1: event\_id\_1 code\_number\_1 sub\_code\_number\_1
log2: event\_id\_1 code\_number\_1 sub\_code\_number\_2 log
I know the messages pattern for code\_number\_1 events, so I know where to find information.
I want to extract:
- info1 inside first message
- info 4 inside second message
(in case of code\_number\_2 event, message patterns would be different, ans I'd need to extract another information in another place inside the messages).
I am totally beginner and I am not sure about how to process with that. What I expacted to do is something like that:
Step #1: extract "event\_id", code\_number" and "sub\_code\_number" with grok
Step #2: use "aggregate" filter to analyze all message with the same event\_id (using a timeout as there is non start/end information in the message)
Step#3: inside the aggregate, use another time "grok" to extract the fields which I want?
Thanks for your help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 4, 2018, 10:56am UTC](https://discuss.elastic.co/t/aggregate-messages-with-different-patterns/114411/2 "2018-02-04T10:56:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.