# Grouping data by id with aggregate

**URL:** <https://discuss.elastic.co/t/grouping-data-by-id-with-aggregate/120803>\
**Category:** Logstash\
**Created:** [February 21, 2018, 9:51am UTC](https://discuss.elastic.co/t/grouping-data-by-id-with-aggregate/120803 "2018-02-21T09:51:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sabdoul](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@sabdoul](https://discuss.elastic.co/u/sabdoul)\
**Post date:** [February 21, 2018, 9:51am UTC](https://discuss.elastic.co/t/grouping-data-by-id-with-aggregate/120803/1 "2018-02-21T09:51:59Z")

</div>

Hello,

I want to group software by an id (pc name). For that I use the aggregate filter. But the grouping does not work.

Maybe I miss something (below my code):

```
input {
 elasticsearch {
   hosts => ["localhost:9200"]
   index => "pc-2018.02.19"
   query => '{ "query": { "query_string": { "query": "*" } },"_source": 
     ["beat.hostname","system.process.name"]}'
   docinfo => true
   docinfo_target => "@metadata"
   scroll => "5m"
   tags => "pc_software"
}
}

 filter {
    if "pc_software" in [tags] {
         aggregate {
           task_id => "%{[beat][hostname]}"
           code => "
                 map['[beat][hostname]'] = event.get('[beat][hostname]')
                 map['software'] ||= []
                 map['software'] << {'[software_name]' => event.get('[system][process][name]')}
                 #event.cancel()
           "
           push_map_as_event_on_timeout => true
           timeout => 1000
        }
       mutate {
         remove_field => ["[beat][hostname]", "[system][process][name]"]
       }
 }
}

output {
  if "pc_software" in [tags] {
     elasticsearch {
        hosts => ["localhost:9200"]
        index => "pc_logiciel-%{+YYYY.MM.dd}"
  }
 }
}

```

Thank you in advance for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 9:52am UTC](https://discuss.elastic.co/t/grouping-data-by-id-with-aggregate/120803/2 "2018-03-21T09:52:26Z")

</div>

Closed on March 21, 2018, 9:52am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.