# Elasticsearch merge two strings

**URL:** <https://discuss.elastic.co/t/elasticsearch-merge-two-strings/140791>\
**Category:** Elasticsearch\
**Created:** [July 19, 2018, 6:52pm UTC](https://discuss.elastic.co/t/elasticsearch-merge-two-strings/140791 "2018-07-19T18:52:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dennys84](https://avatars.discourse-cdn.com/v4/letter/d/898d66/32.png) [@dennys84](https://discuss.elastic.co/u/dennys84)\
**Post date:** [July 19, 2018, 6:52pm UTC](https://discuss.elastic.co/t/elasticsearch-merge-two-strings/140791/1 "2018-07-19T18:52:26Z")

</div>

Hi all. We are facing difficulties, trying to get postfix logs readable in ELK.  
-we installed filebeat and set communication with ELK server  
-then, configured logstash patterns and configs  
-finally we've got logs in kibana discovery fully parsed  
But postfix logs came line by line from different services like qmgr, smtpd, amavis, etc. And not all fields are filled in this strings. Doing some filtering we manage to get two different settings, but each of them displayed separately, by switching filter on|off  
for example,  
filtered log string one: from, -, -, -, -, mesage size  
filtered log string two: to,relayhost,relayip,status

Is there a way to combine it all in one, or at least do some smart filter to show only this two strings simultaneously?  
Thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2018, 6:52pm UTC](https://discuss.elastic.co/t/elasticsearch-merge-two-strings/140791/2 "2018-08-16T18:52:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.