# Is this possible with Aggregate plugin or Ruby? Any ideas?

**URL:** <https://discuss.elastic.co/t/is-this-possible-with-aggregate-plugin-or-ruby-any-ideas/152182>\
**Category:** Logstash\
**Created:** [October 12, 2018, 7:42am UTC](https://discuss.elastic.co/t/is-this-possible-with-aggregate-plugin-or-ruby-any-ideas/152182 "2018-10-12T07:42:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Harshet\_Jain](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)\
**Post date:** [October 12, 2018, 7:42am UTC](https://discuss.elastic.co/t/is-this-possible-with-aggregate-plugin-or-ruby-any-ideas/152182/1 "2018-10-12T07:42:19Z")

</div>

I am trying to combine records from two (or more) sources.

Here is the example:

Source A contains: doc\_id, RecA  
Source B contains: doc\_id, RecB

I want to aggregate them to create

"doc\_id": 44342  
"RecA": "hello"  
"RecB": "I am fine"

Here is my approach:

```
filter {
aggregate {
    task_id => "%{doc_id}"
    code =>
    "
     event.get['doc_id'] = map('doc_id')
     "
   push_previous_map_as_event => true
   timeout => 3
}
}

```

The bigger issue with the aggregate function here would be how to define that it has to look for that DOC\_ID in the other source. Because as the sources are different, they will not come in one-after-the-other. Any ideas?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2018, 7:42am UTC](https://discuss.elastic.co/t/is-this-possible-with-aggregate-plugin-or-ruby-any-ideas/152182/2 "2018-11-09T07:42:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.