# Concatenation between two documents message value

**URL:** <https://discuss.elastic.co/t/concatenation-between-two-documents-message-value/305572>\
**Category:** Elasticsearch\
**Created:** [May 25, 2022, 8:08am UTC](https://discuss.elastic.co/t/concatenation-between-two-documents-message-value/305572 "2022-05-25T08:08:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [May 25, 2022, 8:08am UTC](https://discuss.elastic.co/t/concatenation-between-two-documents-message-value/305572/1 "2022-05-25T08:08:31Z")

</div>

Hi,  
we assume that i have 3 documents in Elasticsearch and here a example of messages that contains  
**document 1 message :**

```auto
2022-01-13 17:16:05 - request in formatHexDump is => 
000: 12 15 46 77 77 55 | ak55s2 ....
000: 12 15 46 77 77 55 | ak55s2 ....
..
FO ... 

```

**document 2 message :**

```auto
2022-01-13 17:16:10 - request in formatHexDump is => 
000: 44 66 99 11 77 55 | h44a5000 ....
000: 45 66 33 22 00 11 | adandakj ....
..
FT ....
..

```

**document 3 message :**

```auto
2022-01-13 17:17:44 - request in formatHexDump is => 
000: 44 33 22 00 11 55 | jjdll1122 ....
000: 12 15 46 77 77 55 | h555666 ....
..
AO ... 
...

```

I separate the logs with filebeat `multiline.pattern: '^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s{3}-\srequest\sin\sformatHexDump\sis\s\S{2}'`  
so in this example i would like to find only two logs not three the first contains the logs which contain `FO` and `FT` together in one message, and the second log contains `AO`  
I mean if there is `FT` in any log take the hole log and put it under the previous log

Any help would be sincerely appreciate!  
Thanks!

---

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [May 25, 2022, 1:28pm UTC](https://discuss.elastic.co/t/concatenation-between-two-documents-message-value/305572/2 "2022-05-25T13:28:20Z")

</div>

I mean if it can be like this :  
**document 1 message field value :**

```auto
2022-01-13 17:16:05 - request in formatHexDump is => 
000: 12 15 46 77 77 55 | ak55s2 ....
000: 12 15 46 77 77 55 | ak55s2 ....
..
FO ...
....
2022-01-13 17:16:10 - request in formatHexDump is => 
000: 44 66 99 11 77 55 | h44a5000 ....
000: 45 66 33 22 00 11 | adandakj ....
..
FT ....
..

```

**document 2 message field value:**

```auto
2022-01-13 17:17:44 - request in formatHexDump is => 
000: 44 33 22 00 11 55 | jjdll1122 ....
000: 12 15 46 77 77 55 | h555666 ....
..
AO ... 
...

```

Thanks!

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [May 26, 2022, 6:33pm UTC](https://discuss.elastic.co/t/concatenation-between-two-documents-message-value/305572/3 "2022-05-26T18:33:30Z")

</div>

If you use Logstash, you can aggregate multiple messages to a single event for some rules by [aggregate filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html). You may use filebeat -\> logstash -\> Elasticsearch, or using only logstash -\> Elasticsearch could be also possible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2022, 6:33pm UTC](https://discuss.elastic.co/t/concatenation-between-two-documents-message-value/305572/4 "2022-06-23T18:33:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.