# Copy last uuid value in the configuration

**URL:** <https://discuss.elastic.co/t/copy-last-uuid-value-in-the-configuration/166825>\
**Category:** Logstash\
**Created:** [February 2, 2019, 4:10pm UTC](https://discuss.elastic.co/t/copy-last-uuid-value-in-the-configuration/166825 "2019-02-02T16:10:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![et159](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@et159](https://discuss.elastic.co/u/et159)\
**Post date:** [February 2, 2019, 4:10pm UTC](https://discuss.elastic.co/t/copy-last-uuid-value-in-the-configuration/166825/1 "2019-02-02T16:10:08Z")

</div>

Hello,  
I'm new to ELK , I have a grok filter to parse logs , I added tags as process started and process ended to calculate the session length for each connection,  
but the session had no session ID , is i generated uuid to be added, but the problem elapsed plugin need two tags with the same uuid to calculate the session time,  
how can I add the same uuid to two different msgs ??

my configuration is looks like below

```
grok {
match => msg1 { add_tag => ["sessionStart"]
}

if [_grokfailer] in [tags] {
remove_tag=> [_grokfailuer]
}

match => msg2 { add_tag => ["sessionEnd"]
}

if ["sessionStart"] or ["sessionEnd"] in [tags] {
uuid {
tagrget => "sessionID"}
}

}

```

but this will create different uuid in each session start or end, and I need them to be the same,  
any thoughts ? thanks in advance

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 2, 2019, 4:19pm UTC](https://discuss.elastic.co/t/copy-last-uuid-value-in-the-configuration/166825/2 "2019-02-02T16:19:13Z")

</div>

Do the events strictly alternate start / end / start / end / start end? If not, how do you know which pairs of events go together?

---

<div class="post-metadata">

**Author:** ![et159](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@et159](https://discuss.elastic.co/u/et159)\
**Post date:** [February 2, 2019, 4:21pm UTC](https://discuss.elastic.co/t/copy-last-uuid-value-in-the-configuration/166825/3 "2019-02-02T16:21:28Z")

</div>

yes, it comes from one source , with clear pattern start/end, and the tags added perfectly , for each pair, just need to solve the uuid issue,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 2, 2019, 4:42pm UTC](https://discuss.elastic.co/t/copy-last-uuid-value-in-the-configuration/166825/4 "2019-02-02T16:42:02Z")

</div>

Something like this should get you started.

```
input { generator { count => 1 lines => ['a1', 'b1', 'a2', 'b2'] } }
filter {
    if [message] =~ /^a/ {
        #start
        mutate { add_tag => ["sessionStart"] }
        fingerprint { target => "uuid" }
        ruby { code => '@@uuid = event.get("uuid")' }
    } else {
        #end
        mutate { add_tag => ["sessionEnd"] }
        ruby { code => 'event.set("uuid", @@uuid)' }
    }
}
output { stdout { } }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2019, 4:42pm UTC](https://discuss.elastic.co/t/copy-last-uuid-value-in-the-configuration/166825/5 "2019-03-02T16:42:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.