# For join I need split and aggregation

**URL:** <https://discuss.elastic.co/t/for-join-i-need-split-and-aggregation/99539>\
**Category:** Logstash\
**Created:** [September 6, 2017, 8:52am UTC](https://discuss.elastic.co/t/for-join-i-need-split-and-aggregation/99539 "2017-09-06T08:52:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)\
**Post date:** [September 6, 2017, 8:52am UTC](https://discuss.elastic.co/t/for-join-i-need-split-and-aggregation/99539/1 "2017-09-06T08:52:54Z")

</div>

Hi in a [different question](https://discuss.elastic.co/t/help-with-doing-join/99524/8) I asked how to do "Join" and got an answer to do:

"to put in LS a split filter that will duplicate the logs. and on the duplicated part I will use the aggregation"

Now I started with the split filter and got stuck.

My configuration file looks like:

```
filter {
    json{
        source => "message"
    }
    split {
  
    }
}

```

Also I tried to do this with clone:

```
filter {
    json{
        source => "message"
    }
    clone {
        add_field => { "foo_%{transactionId}" => "Hello world, from me" }
    }
}

```

This did not duplicate my logs even though [here](https://www.elastic.co/guide/en/logstash/5.0/plugins-filters-split.html#plugins-filters-split-add_tag) it says that split always duplicates, can I get any help.  
And the split does not duplicate my logs. The reason why I didn't add anything inside the "split" is b/c I don't want to add any tag or anything for this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2017, 8:53am UTC](https://discuss.elastic.co/t/for-join-i-need-split-and-aggregation/99539/2 "2017-10-04T08:53:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.