# Combining Netscaler Appflow request and response within Logstash

**URL:** <https://discuss.elastic.co/t/combining-netscaler-appflow-request-and-response-within-logstash/110043>\
**Category:** Logstash\
**Created:** [December 3, 2017, 12:12pm UTC](https://discuss.elastic.co/t/combining-netscaler-appflow-request-and-response-within-logstash/110043 "2017-12-03T12:12:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![scherma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scherma/32/23571_2.png) [@scherma](https://discuss.elastic.co/u/scherma)\
**Post date:** [December 3, 2017, 12:12pm UTC](https://discuss.elastic.co/t/combining-netscaler-appflow-request-and-response-within-logstash/110043/1 "2017-12-03T12:12:20Z")

</div>

Hi all, when using Logstash to parse Netscaler Appflow, I have noted that the Appflow output places request and response information different records. I would like to be able to combine the request and response (they are linked by the "netscalerTransactionId" field). I don't really know Ruby, so I've created something that will perform this task in Python, however that's a bit of an ugly solution. Is it possible to do this within Logstash?

Also if this is not something that exists, is there anyone who would be willing to supply sample Logstash JSON output? I have been testing internally but I want to be sure my code works everywhere, not just on the content I have.

---

<div class="post-metadata">

**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\
**Post date:** [December 5, 2017, 8:36am UTC](https://discuss.elastic.co/t/combining-netscaler-appflow-request-and-response-within-logstash/110043/2 "2017-12-05T08:36:05Z")

</div>

Hi,

Have a look at logstash's mutate add\_field or merge : [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-merge](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-merge)

add\_field would look something like below where new\_field is the name of the field you desire for req&resp to be.

mutate {  
add\_field =\> {  
"new\_field" =\> "%{oldfield1} %{oldfield2}"  
}  
remove\_field =\> ["oldfield1", "oldfield"]  
}

---

<div class="post-metadata">

**Author:** ![scherma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scherma/32/23571_2.png) [@scherma](https://discuss.elastic.co/u/scherma)\
**Post date:** [December 5, 2017, 8:40am UTC](https://discuss.elastic.co/t/combining-netscaler-appflow-request-and-response-within-logstash/110043/3 "2017-12-05T08:40:54Z")

</div>

Hi JKhondhu,

I am aware of add\_field and merge, but these functions get applied to individual messages being processed by Logstash and the issue is that this use case requires two **separate** messages to be combined based on a field with a common value.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2018, 8:41am UTC](https://discuss.elastic.co/t/combining-netscaler-appflow-request-and-response-within-logstash/110043/4 "2018-01-02T08:41:10Z")

</div>

Closed on January 2, 2018, 8:41am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.