# Aggregating 2 log fields

**URL:** <https://discuss.elastic.co/t/aggregating-2-log-fields/380506>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 28, 2025, 2:24pm UTC](https://discuss.elastic.co/t/aggregating-2-log-fields/380506 "2025-07-28T14:24:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![basavesh](https://avatars.discourse-cdn.com/v4/letter/b/9e8a1a/32.png) [@basavesh](https://discuss.elastic.co/u/basavesh)\
**Post date:** [July 28, 2025, 2:24pm UTC](https://discuss.elastic.co/t/aggregating-2-log-fields/380506/1 "2025-07-28T14:24:42Z")

</div>

I have a log file which contains header (printed once per file) & body (multiple log blocks) as shown below.

# Server name = abcdefgh123 Time = 07/09/24 12:23:22 AM

# Country = IN Total = 50 Status = Green

# Country = UK Total = 23 Status = Yellow

Country = US  
Total = 10  
Status = Red

I am pushing logs with help of filebeat.  
Log flow - Filebeat -\> Logstash -\> Elasticsearch.

Here I am trying to aggregate header with each body block, but its failing as all the logs are sent as single event.

Please help if anyone have faced this and know the solution.