# How to map between extracted fields

**URL:** <https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601>\
**Category:** Logstash\
**Created:** [April 25, 2017, 5:11pm UTC](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601 "2017-04-25T17:11:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\
**Post date:** [April 25, 2017, 5:11pm UTC](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601/1 "2017-04-25T17:11:34Z")

</div>

Hello, I am extracting info from logfiles, but I want to map them together for aggregations, here's a sample logfile:

```
2017-01-01 07:53:44 [monitor_utils.py] INFO: Crawled iteration for merchant ariika started
2017-01-01 07:53:44 [utils.py] INFO: UpdateCrawlIteration._start_crawl_iteration function took 0.127 s
2017-01-01 07:57:22 [statscollectors.py] INFO: Dumping Scrapy stats:
{'item_scraped_count': 22,
 'invalid_items_count': 84}

```

I am extracting the merchant name from the first line `ariika` and `items_scraped_counts, invalid_items_count` from the last two lines, I have different logfiles for each merchant, and I want to know items scraped count per logfile for each merchant using Kibana.

How to filter between one merchant and another in my case?

---

<div class="post-metadata">

**Author:** ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\
**Post date:** [April 25, 2017, 5:25pm UTC](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601/2 "2017-04-25T17:25:27Z")

</div>

Should I save each merchant logfiles in a separate elasticseach \_type? I am using one index for all logfiles.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 26, 2017, 5:21am UTC](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601/3 "2017-04-26T05:21:56Z")

</div>

Have you looked using the aggregate filter?

> Should I save each merchant logfiles in a separate elasticseach \_type?

Probably not, but it depends.

---

<div class="post-metadata">

**Author:** ![ibrahimsharaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibrahimsharaf/32/17304_2.png) [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\
**Post date:** [April 26, 2017, 9:32am UTC](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601/4 "2017-04-26T09:32:55Z")

</div>

> [@magnusbaeck](#):
>
> Have you looked using the aggregate filter?

No, I didn't, will take a look.  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2017, 9:35am UTC](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601/5 "2017-05-24T09:35:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.