# How can i get aggregated count of particular errors
**URL:** https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538
**Category:** Logstash
**Created:** [April 18, 2018, 1:06pm UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538 "2018-04-18T13:06:24Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Utkarsh\_Tripathi](https://discuss.elastic.co/u/Utkarsh_Tripathi)
#### Post date: [April 18, 2018, 1:06pm UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/1 "2018-04-18T13:06:24Z")
hi,
I want to get number of times particular error occured on my server.After parsing logs look as below mentioned.
\<
{
"path" =\> "/home/utkarsh/sample.log2016\_07\_21.txt",
"time" =\> "00:00:05,626",
"host" =\> "Laptop-012",
"@version" =\> "1",
"message" =\> "00:00:05,626 ERROR [HealthPackageCronService] - Unable to mark package as expired: ",
"level" =\> "ERROR",
"@timestamp" =\> 2018-04-18T08:18:30.602Z,
"gdata" =\> "[HealthPackageCronService] - Unable to mark package as expired: "
}
>
I want to get how many times a particular error have occured,so that i'm able to find which errors are occuring frequently.Please help
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 22, 2018, 8:11pm UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/2 "2018-04-22T20:11:44Z")
And the `gdata` field contains the error that you want to track? Make sure the field is a keyword field by adjusting the index template you're using, then use Elasticsearch to aggregate on that field and count the frequency of various messages.
---
### Author:  [@Utkarsh\_Tripathi](https://discuss.elastic.co/u/Utkarsh_Tripathi)
#### Post date: [April 23, 2018, 6:44am UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/3 "2018-04-23T06:44:56Z")
thanks @magnusbaeck
yes. gdata field i want to track and get a count of particular error from that.
As i am new to logstash.Can you please tell me how i can achieve this.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 23, 2018, 7:01am UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/4 "2018-04-23T07:01:26Z")
Okay, but what part of my previous answer was unclear?
---
### Author:  [@Utkarsh\_Tripathi](https://discuss.elastic.co/u/Utkarsh_Tripathi)
#### Post date: [April 23, 2018, 7:44am UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/5 "2018-04-23T07:44:01Z")
my requirement is to get aggregation of gdata on a exportable file for mailing purpose (i can done manually) on daily basis
so i don't want elastic search in this scenario
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 23, 2018, 8:16am UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/6 "2018-04-23T08:16:07Z")
Since Logstash doesn't store any events on its own you'll have to build something outside Logstash. You could e.g. have Logstash dump the parsed log events to a file and then at whatever interval you like run a script that parses that file and tabulates the number of errors and produces an output file.
---
### Author:  [@Utkarsh\_Tripathi](https://discuss.elastic.co/u/Utkarsh_Tripathi)
#### Post date: [April 23, 2018, 8:24am UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/7 "2018-04-23T08:24:20Z")
There is one plugin in logstash aggregate filter plugin.Can you please tell me can i use that plugin to achieve my objective or what is its usage?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 23, 2018, 10:01am UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/8 "2018-04-23T10:01:13Z")
You can probably use the aggregate filter, but if you do it'll continuously give you aggregated counts. If you want to produce reports once a day this isn't very practical since you'd have to aggregate the aggregates.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 21, 2018, 10:01am UTC](https://discuss.elastic.co/t/how-can-i-get-aggregated-count-of-particular-errors/128538/9 "2018-05-21T10:01:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.