# Group the fields
**URL:** https://discuss.elastic.co/t/group-the-fields/187115
**Category:** Logstash
**Created:** [June 24, 2019, 12:09pm UTC](https://discuss.elastic.co/t/group-the-fields/187115 "2019-06-24T12:09:00Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Mouloud\_CHIKHOUNE](https://discuss.elastic.co/u/Mouloud_CHIKHOUNE)
#### Post date: [June 24, 2019, 12:09pm UTC](https://discuss.elastic.co/t/group-the-fields/187115/1 "2019-06-24T12:09:00Z")
```
Hi, I have a log file structured like this :
2019-06-20T05:39:27,568 | INFO | qtp441473107-156663 | UID1
2019-06-20T05:39:28,874 | INFO | qtp441473107-156785 | UID1
2019-06-20T05:39:28,879 | INFO | qtp441473107-156786 | UID2
2019-06-20T05:39:28,880 | INFO | qtp441473107-156787 | UID2
I want to retrieve in just one event all the fields which have the same UID and display them in kibana discover. I am using filebeat and logstash 7.0.1. Thank you.
config file logastash:
input {
beats {
port => 5044
}
}
filter {
dissect {
mapping => {
"message" => "%{date}|%{info}|%{ticks}|%{UID}"
}
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "filebeat-pcloulouze-%{+yyyy.MM.dd}"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 24, 2019, 12:14pm UTC](https://discuss.elastic.co/t/group-the-fields/187115/2 "2019-06-24T12:14:01Z")
Use an aggregate filter. Either [example 3](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3) or example 4.
---
### Author:  [@Mouloud\_CHIKHOUNE](https://discuss.elastic.co/u/Mouloud_CHIKHOUNE)
#### Post date: [June 25, 2019, 12:36pm UTC](https://discuss.elastic.co/t/group-the-fields/187115/3 "2019-06-25T12:36:13Z")
```
Hi, I have a log file structured like this :
2019-06-20T05:39:27,568 | INFO | INPUT| UID1
2019-06-20T05:39:28,874 | INFO | INPUT| UID2
2019-06-20T05:39:28,879 | INFO | OUTPUT | UID1
2019-06-20T05:39:28,880 | INFO | OUTPUT | UID2
I want to retrieve in just one event all the fields which have the same UID and display them in kibana discover like this:
@timestamp Jun 25, 2019 @ 14:26:33.245
valUID: UID1
valIN: INPUT
valOUT: OUTPUT
valinfo: INFO
@timestamp Jun 25, 2019 @ 14:26:33.246
valUID: UID2
valIN: INPUT
valOUT: OUTPUT
valinfo: INFO
. I am using filebeat and logstash 7.0.1. Thank you.
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 23, 2019, 12:36pm UTC](https://discuss.elastic.co/t/group-the-fields/187115/4 "2019-07-23T12:36:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.