# Can logstash merge several similar lines into one line?

**URL:** https://discuss.elastic.co/t/can-logstash-merge-several-similar-lines-into-one-line/56884
**Category:** Logstash
**Created:** [August 1, 2016, 11:10am UTC](https://discuss.elastic.co/t/can-logstash-merge-several-similar-lines-into-one-line/56884 "2016-08-01T11:10:10Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sen](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@sen](https://discuss.elastic.co/u/sen)
#### Post date: [August 1, 2016, 11:10am UTC](https://discuss.elastic.co/t/can-logstash-merge-several-similar-lines-into-one-line/56884/1 "2016-08-01T11:10:10Z")

</div>

Hi Folks,

Here is what I have in my json input from my kafka server:  
{"deviceName":"device1", "counter":125}  
{"deviceName":"device1", "counter":125}  
{"deviceName":"device2", "counter":88}  
{"deviceName":"device1", "counter":125}  
{"deviceName":"device2", "counter":88}  
{"deviceName":"device1", "counter":125}  
{"deviceName":"device3", "counter":999}  
{"deviceName":"device3", "counter":999}

I would like to get that in output:  
{"deviceName":"device1", "counter":125, "nbOfTimes":4}  
{"deviceName":"device2", "counter":88, "nbOfTimes":2}  
{"deviceName":"device3", "counter":999, "nbOfTimes":2}

Is that possible to do that with logstash ? If yes, how is that possible ?  
I saw the multine option and I don't think it can do that for me.

Thank you in adavance,

Regards,

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 2, 2016, 10:18am UTC](https://discuss.elastic.co/t/can-logstash-merge-several-similar-lines-into-one-line/56884/2 "2016-08-02T10:18:20Z")

</div>

What about [https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html)

---

<div class="post-metadata">

### Author: ![sen](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@sen](https://discuss.elastic.co/u/sen)
#### Post date: [August 2, 2016, 11:19am UTC](https://discuss.elastic.co/t/can-logstash-merge-several-similar-lines-into-one-line/56884/3 "2016-08-02T11:19:05Z")

</div>

I also found this: [https://github.com/logstash-plugins/logstash-filter-aggregate/issues/36](https://github.com/logstash-plugins/logstash-filter-aggregate/issues/36)

Apparently, it is not still possible to do what I am looking for..

---

<div class="post-metadata">

### Author: ![sen](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@sen](https://discuss.elastic.co/u/sen)
#### Post date: [August 23, 2016, 9:26am UTC](https://discuss.elastic.co/t/can-logstash-merge-several-similar-lines-into-one-line/56884/4 "2016-08-23T09:26:40Z")

</div>

I finally managed to solve this question ! The answer is at the end !!

> <https://github.com/logstash-plugins/logstash-filter-aggregate/issues/36>

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/can-logstash-merge-several-similar-lines-into-one-line/56884/5 "2017-07-06T04:42:07Z")

</div>