# Help with aggregation code

**URL:** <https://discuss.elastic.co/t/help-with-aggregation-code/338794>\
**Category:** Logstash\
**Created:** [July 19, 2023, 1:55pm UTC](https://discuss.elastic.co/t/help-with-aggregation-code/338794 "2023-07-19T13:55:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vymk](https://avatars.discourse-cdn.com/v4/letter/v/7bcc69/32.png) [@vymk](https://discuss.elastic.co/u/vymk)\
**Post date:** [July 19, 2023, 1:55pm UTC](https://discuss.elastic.co/t/help-with-aggregation-code/338794/1 "2023-07-19T13:55:06Z")

</div>

We process mails through multiple modules resulting in logs with the same mail\_id, kinda like this:  
mail\_id\_X module1: key1 key2  
mail\_id\_X module2: key3 key4  
mail\_id\_X module3: key5 key6 key7

What I would like to do is take key5 and key6 from module3 and add it to the document from module2, while leaving module3 as it is:  
mail\_id\_X module1: key1 key2  
mail\_id\_X module2: key3 key4 key5 key6  
mail\_id\_X module3: key5 key6 key7

As module3 can vary or be the same as module1, I understand I have to use push\_map\_as\_event\_on\_timeout, but given my lack of Ruby knowledge, I am complete clueless on the code I need for the aggregation.

```auto
filter {
         grok {
          match => {
            "message" => "{WORD:modul}{GREEDYDATA:log_message}" 
          }
        }
        
        if "modul1" in [modul] {
            grok..
        }
        if "modul2" in [modul] {
            grok..
        }
        if "modul3" in [modul] {
            grok..
        }

        aggregate {
             task_id => "%{mail_id}"
             push_map_as_event_on_timeout => true
             code => ""
             timeout_task_id_field => "mail_id"
             timeout => 5
             timeout_tags => ['_aggregatetimeout']
             }
}

```

Any help would be appreciated!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 19, 2023, 4:06pm UTC](https://discuss.elastic.co/t/help-with-aggregation-code/338794/2 "2023-07-19T16:06:39Z")

</div>

Hard to answer without knowing what the module2 and module3 events look like. Which fields do you want to combine from each one?

---

<div class="post-metadata">

**Author:** ![vymk](https://avatars.discourse-cdn.com/v4/letter/v/7bcc69/32.png) [@vymk](https://discuss.elastic.co/u/vymk)\
**Post date:** [July 20, 2023, 9:07am UTC](https://discuss.elastic.co/t/help-with-aggregation-code/338794/3 "2023-07-20T09:07:21Z")

</div>

Hm sorry, I thought the example lines are sufficient.  
module2 is a spam check and module3 includes the mail subject and a route number, which I'd like to combine with the spam check result. So one can just browse the spam check logs and instantly see the subject and route too.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 20, 2023, 4:22pm UTC](https://discuss.elastic.co/t/help-with-aggregation-code/338794/4 "2023-07-20T16:22:21Z")

</div>

That really doesn't tell me what the events look like, but I would guess at something like

```
code => '
    map["@timestamp"] ||= event.get("@timestamp")
    map["spamCheck"] ||= event.get("spamCheck")
    map["subject"] ||= event.get("subject")
    map["routeNumber"] ||= event.get("routeNumber")
'

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2023, 4:22pm UTC](https://discuss.elastic.co/t/help-with-aggregation-code/338794/5 "2023-08-17T16:22:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.