# Agregation in logstash

**URL:** <https://discuss.elastic.co/t/agregation-in-logstash/129518>\
**Category:** Logstash\
**Created:** [April 25, 2018, 3:10pm UTC](https://discuss.elastic.co/t/agregation-in-logstash/129518 "2018-04-25T15:10:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ca082dcaae565fd0dcae](https://avatars.discourse-cdn.com/v4/letter/c/3da27b/32.png) [@ca082dcaae565fd0dcae](https://discuss.elastic.co/u/ca082dcaae565fd0dcae)\
**Post date:** [April 25, 2018, 3:10pm UTC](https://discuss.elastic.co/t/agregation-in-logstash/129518/1 "2018-04-25T15:10:02Z")

</div>

Hi. I use agregation in logstash to concatenate string logs into one.  
and my agregation field looks in kibana like:

{  
"message": "2018-04-23 10:43:14.439 [I/O 23] http--30150 \>\> "Accept: application/json[\r][\n]""  
},  
{  
"message": "2018-04-23 [I/O 23] http--30150 \>\> "User-Agent: Apache CXF 3.1.7[\r][\n]""  
},  
{  
"message": "2018-04-23 [I/O 23] http--30150 \>\> "Content-Length: 0[\r][\n]""  
},  
{  
"message": "2018-04-23 [I/O 23] http--30150 \>\> "Host: aaa[\r][\n]""  
},  
{  
"message": "2018-04-23 [I/O 23] http--30150 \>\> "Connection: Keep-Alive[\r][\n]""  
},  
{  
"message": "2018-04-23 [I/O 23] http--3ss0150 \>\> "[\r][\n]""

my config to agregate is:  
aggregate {  
task\_id =\> "%{timestamp}"  
code =\> "  
map['timestamp'] = event.get('timestamp')  
map['towns'] ||= []  
map['towns'] \<\< {'message' =\> event.get('message')}  
event.cancel()  
"  
push\_previous\_map\_as\_event =\> true  
timeout =\> 3  
}

how to translate field above into  
"2018-04-23 10:43:14.439 [I/O 23] http--30150 \>\> "Accept: application/json[\r][\n]""  
"2018-04-23 [I/O 23] http--30150 \>\> "User-Agent: Apache CXF 3.1.7[\r][\n]""  
etc...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2018, 3:10pm UTC](https://discuss.elastic.co/t/agregation-in-logstash/129518/2 "2018-05-23T15:10:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.