# Correlate log using logstash aggregate plugin
**URL:** https://discuss.elastic.co/t/correlate-log-using-logstash-aggregate-plugin/297589
**Category:** Logstash
**Created:** [February 18, 2022, 10:19am UTC](https://discuss.elastic.co/t/correlate-log-using-logstash-aggregate-plugin/297589 "2022-02-18T10:19:40Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [February 18, 2022, 10:19am UTC](https://discuss.elastic.co/t/correlate-log-using-logstash-aggregate-plugin/297589/1 "2022-02-18T10:19:40Z")
Hi all
I'm trying to correlate multiple log file into 1 log message send to elastic using aggregate plugin in logstash.
```auto
2022-02-18T09:51:25.528Z,mail-srv\Client mail-srv,08D9DD5FF4988FD5,37,192.168.1.1:587,192.168.2.2:60095,*,,User Name: NULL
2022-02-18T09:51:25.528Z,mail-srv\Client mail-srv,08D9DD5FF4988FD5,19,192.168.1.1:587,192.168.2.2:60095,>,235 2.7.0 Authentication successful,
```
Now i want to from same id `08D9DD5FF4988FD5` i can get this two log messge into 1 log message like this
```auto
2022-02-18T09:51:25.528Z,mail-srv\Client mail-srv,08D9DD5FF4988FD5,37,192.168.1.1:587,192.168.2.2:60095,User Name: NULL,235 2.7.0 Authentication successful,
```
Or somethings like that.
I have tried this config
```auto
filter {
aggregate {
task_id => "%{id}"
code => "
map['mail_data'] ||= event.get('mail.data')
map['mail_context'] ||= event.get('mail.context')
"
push_map_as_event_on_timeout => true
timeout_task_id_field => "id"
timeout => 30
timeout_tags => ['_aggregatetimeout']
}
}
```
the `mail.data` field is `User Name: NULL` and the `mail.context` is `235 2.7.0 Authentication successful`
Thanks for your time.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 18, 2022, 5:29pm UTC](https://discuss.elastic.co/t/correlate-log-using-logstash-aggregate-plugin/297589/2 "2022-02-18T17:29:08Z")
> [@lusynda](#):
>
> `push_map_as_event_on_timeout`
When you use this the only data in the event that aggregate creates is what you added to the map. If you want additional parts of the original message in that event then you must add them to the map.
---
### Author:  [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [February 23, 2022, 7:39am UTC](https://discuss.elastic.co/t/correlate-log-using-logstash-aggregate-plugin/297589/3 "2022-02-23T07:39:36Z")
Ok but is that why my config does not working like at all.
---
### Author:  [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [February 23, 2022, 9:33am UTC](https://discuss.elastic.co/t/correlate-log-using-logstash-aggregate-plugin/297589/4 "2022-02-23T09:33:34Z")
The current problems for me is that i have tried the config multiple time and it is not working for me. It is not aggregated, notthing happened.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2022, 9:34am UTC](https://discuss.elastic.co/t/correlate-log-using-logstash-aggregate-plugin/297589/5 "2022-03-23T09:34:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.