# Combine and enrich data before ingestion

**URL:** <https://discuss.elastic.co/t/combine-and-enrich-data-before-ingestion/160974>\
**Category:** Elasticsearch\
**Created:** [December 14, 2018, 9:41pm UTC](https://discuss.elastic.co/t/combine-and-enrich-data-before-ingestion/160974 "2018-12-14T21:41:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gerasimos](https://avatars.discourse-cdn.com/v4/letter/g/d26b3c/32.png) [@gerasimos](https://discuss.elastic.co/u/gerasimos)\
**Post date:** [December 14, 2018, 9:41pm UTC](https://discuss.elastic.co/t/combine-and-enrich-data-before-ingestion/160974/1 "2018-12-14T21:41:05Z")

</div>

Hello,

I have a web application that generate log files which are then ingested to via Beat-Logstash to ElasticSearch. Now I need to combine information from different log lines or even different log files before insert the log documents to elasticsearch.

E.g. the **username** below appears in line 50 but I need to also include it in the document of line 100, which refers to a user action. The glue between the two lines in the session-id.

```auto
50: [2018-12-13 13:45:32] [INFO] [Yud52I234hGVgdj] User with username=test loggedin with success
51: [2018-12-13 13:45:33] [INFO] [Yud52I234hGVgdj] Initializing user assets
...
100: [2018-12-13 13:48:15] [INFO] [Yud52I234hGVgdj] Page Catalogue entered

```

I want **username** from line 50 to populate to the document of line 100.

Are there approaches to enrich the data during ingest, other than add the **username** in the log of line 100?

Thank you!

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [December 17, 2018, 10:27am UTC](https://discuss.elastic.co/t/combine-and-enrich-data-before-ingestion/160974/2 "2018-12-17T10:27:26Z")

</div>

If you are looking to analyse behaviour of sessions taking an [entity-centric indexing approach](https://twitter.com/elasticmark/status/1009380268409610240) may be of interest.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2019, 10:27am UTC](https://discuss.elastic.co/t/combine-and-enrich-data-before-ingestion/160974/3 "2019-01-14T10:27:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.