# Global variables

**URL:** <https://discuss.elastic.co/t/global-variables/46943>\
**Category:** Logstash\
**Created:** [April 11, 2016, 5:54am UTC](https://discuss.elastic.co/t/global-variables/46943 "2016-04-11T05:54:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [April 11, 2016, 5:54am UTC](https://discuss.elastic.co/t/global-variables/46943/1 "2016-04-11T05:54:55Z")

</div>

My data is in the format

Feb 22 23:13:35 ams2-eu2-c-smsm query[84218]: { Zqlquery : { Select: { Fieldnames: [1, respsize, reqsize] }, { FieldTypes: [LONG, U\_INT, U\_INT] }, { Functionames: [count, sum, +] }}  
, { Where: { Fieldnames: [filetype, SM\_APPLICATION\_VND\_ANDROID\_PACKAGE\_ARCHIVE\_APK, SM\_APPLICATION\_OCTET\_STREAM\_IPA, policy, 11, 32, 21, 23, 65, 25, 27, 64, 61, 58, 38, 59, 60, 24, 3 7] }, { FieldTypes: [ENUM, U\_SHORT, U\_SHORT, ENUM, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG, LONG] }, { Functionames: [and, in] }}, { GROUP BY: { Fieldnames: [time, 86400, threatname, urlcategory, malware, filetype] }, { FieldTypes: [TIME\_T, LONG, STRING, ENUM, U\_SHORT, ENUM] }, { Functionames: [interval] }}, }

Feb 22 23:13:35 ams2-eu2-c-smsm query[84218]: { ZQL query time: 1185.57 secs}

I want logstash to process these two lines as one event based on the processid, i thought of using mutliline codec but there is a possibility that these two lines are not immediately following lines, I need to store the pid of the line1 and whenever i found line 2, I need to compare the processid and if it matches with any old event I need to add this querytime field for the old event. Is there any way to do that?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 11, 2016, 6:08am UTC](https://discuss.elastic.co/t/global-variables/46943/2 "2016-04-11T06:08:21Z")

</div>

Have a look at the aggregate filter.

---

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [April 11, 2016, 6:16am UTC](https://discuss.elastic.co/t/global-variables/46943/3 "2016-04-11T06:16:06Z")

</div>

Thanks, This is exactly what i need.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/global-variables/46943/4 "2017-07-06T05:02:59Z")

</div>