# First occurrence of multiple same log messages **URL:** \ **Category:** Logstash\ **Created:** [December 18, 2017, 11:09am UTC](https://discuss.elastic.co/t/first-occurrence-of-multiple-same-log-messages/112214 "2017-12-18T11:09:31Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Shubhank\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhank_gupta/32/25038_2.png) [@Shubhank\_Gupta](https://discuss.elastic.co/u/Shubhank_Gupta)\ **Post date:** [December 18, 2017, 11:09am UTC](https://discuss.elastic.co/t/first-occurrence-of-multiple-same-log-messages/112214/1 "2017-12-18T11:09:31Z")
I want to note down the first occurrence of a particular log type and adding key event according to that. Also after that if same type of log comes again than don't do anything till the type of log doesn't changes. How to achieve this purpose ? If i can use variable (e.g. flag variable) which can be used as mark for log occurrence. Is there any kind of memory associated with variable in logstash so that it doesn't lost for further log message till file ends. Let me take an example to make clear the question log messages contain two types of logs i.e server up or server down. if server up comes no issue key event will be added but first occurrence of server down message should be note down and further server down log messages should be ignored till server up message doesn't come. How to do this ? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 15, 2018, 11:09am UTC](https://discuss.elastic.co/t/first-occurrence-of-multiple-same-log-messages/112214/2 "2018-01-15T11:09:43Z")
Closed on January 15, 2018, 11:09am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.