# How to compare to log line and add additional fields
**URL:** https://discuss.elastic.co/t/how-to-compare-to-log-line-and-add-additional-fields/160285
**Category:** Logstash
**Created:** [December 11, 2018, 4:06am UTC](https://discuss.elastic.co/t/how-to-compare-to-log-line-and-add-additional-fields/160285 "2018-12-11T04:06:38Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Sanjeev7](https://discuss.elastic.co/u/Sanjeev7)
#### Post date: [December 11, 2018, 4:06am UTC](https://discuss.elastic.co/t/how-to-compare-to-log-line-and-add-additional-fields/160285/1 "2018-12-11T04:06:39Z")
Hello
Sample Log -
2018-12-09 22:25:11,959162184: INFO : [serviceAd : 1] service: transaction started, transactionnum : 12345
2018-12-09 22:26:14,330574541: INFO : [serviceAd : 1] service: transaction ended, transaction : 12345
2018-21-09 22:27:15,076638900: INFO : [serviceAd : 1] service: transaction started, transaction : 6789
I have requirement where i need to show not processed transaction count in kibana, However i able to extract the transaction started and transactionnum from above log. looking your help
1. compare the transactionnum e.g. 12345 and transaction status like started or ended
2. if transaction started is not available in log with ended it means it incomplete transaction
3. incomplete transaction count display on kibana.
I dont know how to compare to line and hold that result for comparison. Please help me its urgent requirement
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [December 11, 2018, 10:53am UTC](https://discuss.elastic.co/t/how-to-compare-to-log-line-and-add-additional-fields/160285/2 "2018-12-11T10:53:31Z")
This is what the [aggregate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-description) is for - but pay very special attention to the requirement that workers needs to be set to 1 so the same filter instance sees all the events.
The [example in our docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example1) is pretty close to what you need.
---
### Author:  [@Sanjeev7](https://discuss.elastic.co/u/Sanjeev7)
#### Post date: [December 12, 2018, 6:10pm UTC](https://discuss.elastic.co/t/how-to-compare-to-log-line-and-add-additional-fields/160285/3 "2018-12-12T18:10:22Z")
Thanks for reply as per example in url for aggregate filter is required to log should have in sequence.in my case its not possible that end task always come after start .
2. is possible to push more value in Map (like map['sql\_duration']) if yes how to push and retrieve
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 9, 2019, 6:19pm UTC](https://discuss.elastic.co/t/how-to-compare-to-log-line-and-add-additional-fields/160285/4 "2019-01-09T18:19:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.