# How to aggregate a value repeatedly

**URL:** https://discuss.elastic.co/t/how-to-aggregate-a-value-repeatedly/110213
**Category:** Logstash
**Created:** [December 4, 2017, 9:21pm UTC](https://discuss.elastic.co/t/how-to-aggregate-a-value-repeatedly/110213 "2017-12-04T21:21:54Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![magdieldominguez](https://avatars.discourse-cdn.com/v4/letter/m/0ea827/32.png) [@magdieldominguez](https://discuss.elastic.co/u/magdieldominguez)
#### Post date: [December 4, 2017, 9:21pm UTC](https://discuss.elastic.co/t/how-to-aggregate-a-value-repeatedly/110213/1 "2017-12-04T21:21:54Z")

</div>

Hi I have a log file and in each line it contains a number that I need to keep adding to get the total produced per log.

So some of the lines in the log file could be...  
`10.05.17 20:06:39.79 UPDATE/Add: Legs:15`  
`10.05.17 20:06:39.79 UPDATE/Add: Legs:30`

I want to add up the number after Legs to be able to get a total of 45 but im having a hard time doing that. Help would be greatly appreciated. I am using the aggregate filter but not sure how to use it in this case.

my config file looks something like this.

```
input {
   file {
         path => "C:\Logstash\logstash-5.6.1\ExampleLogs\legs.log"
         type => "legs"
         start_position => "beginning"
        }
  }
   filter{
   if [type] == "legs" {
 	  grok {
 	  match => ["message", "(?<OriginalLogTime>%{MONTHNUM}.%{MONTHDAY}.%{YEAR} %{TIME})%{SPACE}(?<legCount>%{DATA:StatusEvent}:%{SPACE}Legs:?%{SPACE}%{BASE16NUM:theLegs})%{GREEDYDATA:message}"]
 	  }
   
 	  mutate {
       convert => { "theLegs" => "integer" }
       }
 
       aggregate {
        task_id => "%{P.23.P24.ABK}"
        code => "map['total_legs'] ||= 0 ; map['total_legs'] += event.get('theLegs')"
        push_map_as_event_on_timeout => true
       }
   }

  }
 output {
   if [type] == "legs" {
     elasticsearch {
       index => "legsloaded"
       hosts => "localhost:9200"
     } 
   }

```

I know the filter is a little confusing but it does work. I check Kibana but there is no total\_legs field created not sure what I am doing wrong.

thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2018, 9:22pm UTC](https://discuss.elastic.co/t/how-to-aggregate-a-value-repeatedly/110213/2 "2018-01-01T21:22:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.