# How can i populate/copy an event field for every event line?

**URL:** https://discuss.elastic.co/t/how-can-i-populate-copy-an-event-field-for-every-event-line/261011
**Category:** Logstash
**Created:** [January 13, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-can-i-populate-copy-an-event-field-for-every-event-line/261011 "2021-01-13T14:36:57Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![EHE](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@EHE](https://discuss.elastic.co/u/EHE)
#### Post date: [January 13, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-can-i-populate-copy-an-event-field-for-every-event-line/261011/1 "2021-01-13T14:36:57Z")

</div>

Hello,

I am struggling with the below I multiple log line mappings and there is one specific field i would like to populate for the logline before and after, currently i am only getting it on the exact same line where the field exist, but i would like to extend it for every line:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/046a2768bed590035e2b0ca29b6db1b955e71ce5.png)

My current mapping is:

' if "module" in [tags] {  
aggregate {  
task\_id =\> "%{pid}"  
code =\> "event.set('modulename', [event.get('module\_name')])"  
map\_action =\> "create"  
}  
}  
if "module" not in [tags] {  
aggregate {  
task\_id =\> "%{pid}"  
code =\> "event.set('modulename2', map['modulename'])"  
map\_action =\> "update"  
end\_of\_task =\> true  
}  
} '

I am not sure what i am doing wrong, I am new to aggregate filter and in general to logstash.  
Your help is appreciated very much !

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 10, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-can-i-populate-copy-an-event-field-for-every-event-line/261011/2 "2021-02-10T14:36:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.