# Grok and aggregate log information
**URL:** https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163
**Category:** Logstash
**Created:** [April 3, 2019, 10:21am UTC](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163 "2019-04-03T10:21:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Lebedev](https://discuss.elastic.co/u/Lebedev)
#### Post date: [April 3, 2019, 10:21am UTC](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163/1 "2019-04-03T10:21:46Z")
Dear, collegues pls help me!
I have input log following format:
Exm:
1 value
1 100
1 value1
2 mean
2 text
2 something
3 SOAP
3 example\_text
I need to convert output log in Real-time in the foloving view:
1 value 100 value1
2 mean text something
3 SOAP example\_text
Well, i wrote grok and mutate filter in my logstash:
if "gateway\_ssl" in [tags] {
mutate {
gsub =\> ["message","\t", " "]
add\_tag =\> ["mutate"]
}
grok {
match =\> {
"message" =\> ["%{BACULA\_DEVICE:transaction\_id} ?%{GREEDYDATA:text\_message}"]}
```
add_tag => ["grokked"]
overwrite => ["message"]
} #grok
```
}#if\_gateway
Could you help me to write aggregate filter for my task?
Thank you a lot!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 3, 2019, 12:49pm UTC](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163/2 "2019-04-03T12:49:25Z")
This would match [example 3](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3) in the aggregate documentation. Use transaction\_id as the task id, and keep appending text\_message to a string in the map.
---
### Author:  [@Lebedev](https://discuss.elastic.co/u/Lebedev)
#### Post date: [April 4, 2019, 9:55am UTC](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163/3 "2019-04-04T09:55:47Z")
Sorry, i feel that i did't finaly understand..
Check pls my future config:
As far as i understood i need to do following config:
aggregate {
task\_id = %{transaction\_id}
code = map['test1'] =' '; map['test1'] += event.get('text\_message')
map\_action = create\_or\_update
push\_map\_as\_event\_on\_timeout = true
timeout = 120
timeout\_tags = ['aggregated']
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 4, 2019, 11:22am UTC](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163/4 "2019-04-04T11:22:28Z")
You may want to add
```
timeout_task_id_field => "transaction_id"
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 2, 2019, 11:22am UTC](https://discuss.elastic.co/t/grok-and-aggregate-log-information/175163/5 "2019-05-02T11:22:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.