# Aggregate multiple events based on file

**URL:** <https://discuss.elastic.co/t/aggregate-multiple-events-based-on-file/256650>\
**Category:** Logstash\
**Created:** [November 25, 2020, 11:50am UTC](https://discuss.elastic.co/t/aggregate-multiple-events-based-on-file/256650 "2020-11-25T11:50:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muhammad\_Faisal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammad_faisal/32/79213_2.png) [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\
**Post date:** [November 25, 2020, 11:50am UTC](https://discuss.elastic.co/t/aggregate-multiple-events-based-on-file/256650/1 "2020-11-25T11:50:21Z")

</div>

hi ,  
i have below directory structure and each subnode contains multiple log files which are generated daily and closed and then next day or some time after couple of days another file is generated and closed....i am capturing 3 events from each log file but there is no matching id or pattern in these events to "aggregate" them into 1 event...can we aggregate these 3 events based on the file being read for that day ?

-nodes

- 

```
    subnode1 subnode2 subnode3 etc.....
      subnode1
       file1_today.txt ,file2_yesterday.txt etc...........
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2020, 11:50am UTC](https://discuss.elastic.co/t/aggregate-multiple-events-based-on-file/256650/2 "2020-12-23T11:50:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.