# How to aggregate multiple events into single output
**URL:** https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536
**Category:** Logstash
**Created:** [July 1, 2020, 7:31pm UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536 "2020-07-01T19:31:11Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@pvaithee07](https://discuss.elastic.co/u/pvaithee07)
#### Post date: [July 1, 2020, 7:31pm UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536/1 "2020-07-01T19:31:11Z")
Hi All -
I am trying to create a logstash pipeline, that reads all the events in that pipeline, aggregates and produces one single output to elastic search.
i/p looks like this -
'''
{
'entity': '1212',
...
},
{
'entity': '1313',
...
},
{
'entity': '1414',
...
}
'''
My output should look something like this -
'''
{
'entries': {
'entity': [1212, 1313, 1414]
},
'count' : 3
}
'''
How can i achieve this? Any help is appreciated. Thanks.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 12, 2020, 11:45pm UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536/2 "2020-07-12T23:45:56Z")
Use an aggregate filter, something like [example three](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3) in the documentation.
In the code option do something like
```
map["entity"] ||= []
map["entity"] << event.get("entity")
```
and in the timeout\_code option do an event.set of count based on the array length.
---
### Author:  [@pvaithee07](https://discuss.elastic.co/u/pvaithee07)
#### Post date: [July 20, 2020, 6:28am UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536/3 "2020-07-20T06:28:47Z")
Thank you. But is there an option like end of event instead of giving a timeout option? In my case, i gave a inactive time of 3 secs and then push the event. But ideally, it should be end of that specific event.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 20, 2020, 4:49pm UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536/4 "2020-07-20T16:49:55Z")
If you can detect the end of an event you might be able to do something like example 4, or even example 1 or 2.
---
### Author:  [@pvaithee07](https://discuss.elastic.co/u/pvaithee07)
#### Post date: [July 21, 2020, 4:42am UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536/5 "2020-07-21T04:42:25Z")
Thank you. Will check that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 18, 2020, 4:42am UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-into-single-output/239536/6 "2020-08-18T04:42:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.