Can logstash merge several similar lines into one line?

Elastic Stack Logstash
1

Hi Folks,

Here is what I have in my json input from my kafka server:
{"deviceName":"device1", "counter":125}
{"deviceName":"device1", "counter":125}
{"deviceName":"device2", "counter":88}
{"deviceName":"device1", "counter":125}
{"deviceName":"device2", "counter":88}
{"deviceName":"device1", "counter":125}
{"deviceName":"device3", "counter":999}
{"deviceName":"device3", "counter":999}

I would like to get that in output:
{"deviceName":"device1", "counter":125, "nbOfTimes":4}
{"deviceName":"device2", "counter":88, "nbOfTimes":2}
{"deviceName":"device3", "counter":999, "nbOfTimes":2}

Is that possible to do that with logstash ? If yes, how is that possible ?
I saw the multine option and I don't think it can do that for me.

Thank you in adavance,

Regards,

2

What about https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html

1 Like
3

I also found this: https://github.com/logstash-plugins/logstash-filter-aggregate/issues/36

Apparently, it is not still possible to do what I am looking for..

4

I finally managed to solve this question ! The answer is at the end !!