We process mails through multiple modules resulting in logs with the same mail_id, kinda like this: mail_id_X module1: key1 key2 mail_id_X module2: key3 key4 mail_id_X module3: key5 key6 key7 What I would like to do is take key5 and key6 from module3 and add it to the document from module2, whil…

Help with aggregation code

Badger July 19, 2023, 4:06pm 2

Hard to answer without knowing what the module2 and module3 events look like. Which fields do you want to combine from each one?

Topic		Replies	Views
Logstash Aggregate copy last Event to Map Logstash	4	1471	November 4, 2020
Aggregate filter (Combine Logs) Logstash	2	347	April 24, 2018
Combine 2 events into one Logstash	2	4141	February 8, 2017
Understanding the aggregation filter: Logstash	1	1667	October 16, 2017
Aggregate filter push map Logstash	2	417	August 16, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Help with aggregation code

Related topics