# Aggregate similar Logs **URL:** \ **Category:** Logstash\ **Created:** [April 18, 2022, 3:27pm UTC](https://discuss.elastic.co/t/aggregate-similar-logs/302630 "2022-04-18T15:27:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Bo-Wyatt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bo-wyatt/32/87748_2.png) [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Post date:** [April 18, 2022, 3:27pm UTC](https://discuss.elastic.co/t/aggregate-similar-logs/302630/1 "2022-04-18T15:27:26Z")
Hello, I have SIEM-like logs (with a unique identifier field) in a log flow (two or more logs, in every update/log there's extra info or updaded info). I need to preserve the last log or aggregate all the logs into one with only the non-repeated info or new fields. How can I do this? I know there's the aggregate plugin but I don't think it's for this scenario. Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 19, 2022, 4:53pm UTC](https://discuss.elastic.co/t/aggregate-similar-logs/302630/2 "2022-04-19T16:53:20Z")
You might be able to use an aggregate filter. [Another option](https://discuss.elastic.co/t/aggregate-problem/142572/7) might be to have logstash output a text file that you can curl into the Elasticsearch \_bulk API. ---
**Author:** ![Bo-Wyatt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bo-wyatt/32/87748_2.png) [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Post date:** [April 22, 2022, 11:39am UTC](https://discuss.elastic.co/t/aggregate-similar-logs/302630/3 "2022-04-22T11:39:32Z")
Can I merge all the logs to one using aggregate filter? I'm not quite understanding the plugin, in my pipeline I have various filters and mutates to my data (my events come one after the other) Can I keep them? I just want to add the extra fields that each log adds as an update. My thought was not do make a script to curl to Elasticsearch but if there's no other option I can take it. EDIT: My use case is similar to the explained [here](https://discuss.elastic.co/t/keeping-same-log-events-once-instead-of-multiple-time/239301/2): ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 20, 2022, 11:39am UTC](https://discuss.elastic.co/t/aggregate-similar-logs/302630/4 "2022-05-20T11:39:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.