# Group multiple metric to one event

**URL:** https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842
**Category:** Beats
**Tags:** metricbeat
**Created:** [July 20, 2020, 6:32am UTC](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842 "2020-07-20T06:32:42Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![CHU\_XU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chu_xu/32/45946_2.png) [@CHU\_XU](https://discuss.elastic.co/u/CHU_XU)
#### Post date: [July 20, 2020, 6:32am UTC](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842/1 "2020-07-20T06:32:42Z")

</div>

Hi all,

I'm using metricbeat to collect some instance metrics with system module. When I set cpu, memory and network in the metricsets, I found that metricbeat actually emit three lines of log repestively. Can I merge these events into one because my monitor service is expecting a log with all these metrics like "{"cpu":"27","memory":"1234m","network":"50"}".

Thanks

---

<div class="post-metadata">

### Author: ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [July 20, 2020, 9:25am UTC](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842/2 "2020-07-20T09:25:52Z")

</div>

I'm afraid that you can't merge them

---

<div class="post-metadata">

### Author: ![CHU\_XU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chu_xu/32/45946_2.png) [@CHU\_XU](https://discuss.elastic.co/u/CHU_XU)
#### Post date: [July 22, 2020, 2:14am UTC](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842/3 "2020-07-22T02:14:15Z")

</div>

Or can I split a event to multiple line? Since I can not aggregate them, I may want to totally separate the metrics.  
For example a system.cpu metricset returns both cpu usage and cpu idle, then I'd like to have two logs respectively. Will script processor help?

---

<div class="post-metadata">

### Author: ![Hendrik\_Muhs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendrik_muhs/32/25802_2.png) [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [July 22, 2020, 7:11am UTC](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842/4 "2020-07-22T07:11:40Z")

</div>

What monitor service do you use?

It's possible to group(merge) all metrics on elastic side using a [transform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html), that means you would index metricbeat data as is and have a transform which queries that index and writes a secondary index, which transforms the data into the format you want. It's advised to use at least `7.7`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 19, 2020, 9:11am UTC](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842/5 "2020-08-19T09:11:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
