# How to aggregate using name in Logstash Filter Elasticsearch Query

**URL:** <https://discuss.elastic.co/t/how-to-aggregate-using-name-in-logstash-filter-elasticsearch-query/124810>\
**Category:** Logstash\
**Created:** [March 20, 2018, 3:44pm UTC](https://discuss.elastic.co/t/how-to-aggregate-using-name-in-logstash-filter-elasticsearch-query/124810 "2018-03-20T15:44:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [March 20, 2018, 3:44pm UTC](https://discuss.elastic.co/t/how-to-aggregate-using-name-in-logstash-filter-elasticsearch-query/124810/1 "2018-03-20T15:44:50Z")

</div>

I amusing ELK version 5.2.0 and I am trying to aggregate some fields from another index in logstash-filter-elasticsearch using the **name** or **email** or **userid**.

Below is my query

```
query => "type:user AND (email.keyword:%{user} OR first_name.keyword:%{[user]} OR userid:%{user})"

```

Email and userid aggregation are working perfectly but the name comparison is not working as expected. for eg;  
**usecase 1**

```
user : moving the method...
firstname.keyword: poulin

```

In my case the `usecase1` should get failed and aggregation should not happen but its happening

**usecase 2**

```
user : Belinda Lynn
firstname.keyword: Lynn

```

Same for `usecase2` also.

From this comparison I believe the name field is not matching with fulltext. I am looking for guidance and inputs to achieve my aggregation with exact match on the name fieds.

---

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [March 30, 2018, 9:28pm UTC](https://discuss.elastic.co/t/how-to-aggregate-using-name-in-logstash-filter-elasticsearch-query/124810/2 "2018-03-30T21:28:28Z")

</div>

@magnusbaeck any thoughts on this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2018, 9:28pm UTC](https://discuss.elastic.co/t/how-to-aggregate-using-name-in-logstash-filter-elasticsearch-query/124810/3 "2018-04-27T21:28:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.