# Considering the last selection log **URL:** \ **Category:** Logstash\ **Created:** [April 3, 2019, 4:37am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096 "2019-04-03T04:37:16Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 3, 2019, 4:37am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/1 "2019-04-03T04:37:16Z")
hi there, I am stuck with a specific issue related to clickstream log. It's based on the selection made by the user.If a user selects something then the request gets added up in the request parameter. I am posting a sample log over here so that you can better understand the problem -\>2019-03-28T09:41:15,273 hostname pid module thread someid POST selectionguides/searchbyid/DEMO/test2/FRA/FR {languageID=FR, selectionGuideGlobalID=test2, projectId=DEMO, countryID=FRA} {} {"A":"X"} 200 152 -\>2019-03-28T09:41:22,989 hostname pid module thread someid POST selectionguides/searchbyid/DEMO/test2/FRA/FR {languageID=FR, selectionGuideGlobalID=test2, projectId=DEMO, countryID=FRA} {} {"A":"X","B":"Y"} 200 138 -\>2019-03-28T09:41:23,900 hostname pid module thread someid POST selectionguides/searchbyid/DEMO/test2/FRA/FR {languageID=FR, selectionGuideGlobalID=test2, projectId=DEMO, countryID=FRA} {} {"A":"X","B":"Y","C":"Z"} 200 88 In the above log, you can see that the request body which is at the last gets added up everytime with the selection made by user like this:- {"A":"X"} {"A":"X","B":"Y"} {"A":"X","B":"Y","C":"Z"} I want the last log only for my purpose.So, please recommend me something for this. ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 3, 2019, 9:41am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/2 "2019-04-03T09:41:01Z")
Write now I am trying with aggregation filter in logstash by putting if-else condition. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 3, 2019, 1:03pm UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/3 "2019-04-03T13:03:45Z")
I would suggest something like [example 3](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3) in the aggregate documentation, but keep overwriting the map entry with the most recent value of the request body. ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 5, 2019, 4:32am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/4 "2019-04-05T04:32:04Z")
Is there any way to take the last log with the latest timestamp??In this way, only the last log will be available for my analysis. Then I'll aggregate based on my requirement ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 5, 2019, 6:27am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/5 "2019-04-05T06:27:28Z")
hi there, Here I have created one list 'request\_body'. map['request\_body'] \<\< {'request' =\> event.get('request')} Can u tell me that how should I access the last element of that list. I just want the syntax ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 5, 2019, 12:33pm UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/6 "2019-04-05T12:33:30Z")
If you only want the last entry then do not append using \<\<, just overwrite using = ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 8, 2019, 5:01am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/7 "2019-04-08T05:01:40Z")
I tried that, but now it is giving output for every request. Basically my aggregation is not working .I wanted it first to be aggregated based on user id and stored in one list('request\_body') by using this-\> map['request\_body'] \<\< {'request' =\> event.get('request')} Then I wanted to select the last element from that list. ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 9, 2019, 6:02am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/8 "2019-04-09T06:02:35Z")
I have written this code for aggreagation:-\> ``` aggregate { task_id => "%{[CorrelationId][paths]}" code => " map['CorrelationId'] = event.get('CorrelationId') map['paths'] = event.get('paths') map['request_body'] ||= [] if (event.get('request') != nil) if !( map['request_body'].include? event.get('request') ) map['request_body'] = event.get('request') end end event.cancel() " push_previous_map_as_event => true timeout => 3 } ``` I don't know why it is giving me output for each and every logs ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 9, 2019, 6:15am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/9 "2019-04-09T06:15:03Z")
I am getting my request\_body as For 1st log request\_body{ "A=X" } For 2nd log request\_body{ "A"="X", "B"="Y", } but I want the last request\_body only. plz help ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 9, 2019, 12:39pm UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/10 "2019-04-09T12:39:41Z")
You have not shown us what an event looks like, so we cannot say what is wrong with the aggregate filter. Either show us the filter {} section, or show us an event with output { stdout { codec =\> rubydebug } } ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 10, 2019, 4:10am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/11 "2019-04-10T04:10:13Z")
![tempsnip_LI](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f074ddcac49664b28133a8bdf5c2c8c43561ce9e.jpeg) Check the request\_body part, for one log I am getting request\_body{ "A"="X" } for another log I am getting request\_body{ "A"="X", "B"="Y", } So, basically I want the final one(2nd one),as it contains the element of the previous log also. ---
**Author:** ![satyajeet\_dutt](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@satyajeet\_dutt](https://discuss.elastic.co/u/satyajeet_dutt)\ **Post date:** [April 25, 2019, 10:31am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/12 "2019-04-25T10:31:55Z")
Please reply ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 23, 2019, 10:32am UTC](https://discuss.elastic.co/t/considering-the-last-selection-log/175096/13 "2019-05-23T10:32:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.