# Join two logs by common field

**URL:** <https://discuss.elastic.co/t/join-two-logs-by-common-field/65622>\
**Category:** Logstash\
**Created:** [November 10, 2016, 10:04am UTC](https://discuss.elastic.co/t/join-two-logs-by-common-field/65622 "2016-11-10T10:04:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Basem\_Mohammed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/basem_mohammed/32/13234_2.png) [@Basem\_Mohammed](https://discuss.elastic.co/u/Basem_Mohammed)\
**Post date:** [November 10, 2016, 10:04am UTC](https://discuss.elastic.co/t/join-two-logs-by-common-field/65622/1 "2016-11-10T10:04:15Z")

</div>

Hello,

I am trying to get a useful information from two logs format. Let me Start the call flow.

Msgs:-

dhcp,info dhcp 414 assigned 10.101.193.4 to F0: **:** : **:** :40  
hotspot,account,info,debug cb8xgh (10.101.193.4): logged in  
hotspot,info,debug cb8xgh (10.101.193.4): logged out: session timeout  
dhcp,info dhcp 414 deassigned 10.101.193.4 from F0: **:** : **:** :40

I can parse each one individually, And as you can see IP address is the common term. So, I want to bind those logs as I can read " The specific IP address for the specific username assigned to this mac "..

My ultimate goal is to be able to get the session details like that: username used a mac address, logged in at a time,logged out at a time.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 12, 2016, 6:09pm UTC](https://discuss.elastic.co/t/join-two-logs-by-common-field/65622/2 "2016-11-12T18:09:30Z")

</div>

Does the collate filter help?

---

<div class="post-metadata">

**Author:** ![Basem\_Mohammed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/basem_mohammed/32/13234_2.png) [@Basem\_Mohammed](https://discuss.elastic.co/u/Basem_Mohammed)\
**Post date:** [November 16, 2016, 2:51pm UTC](https://discuss.elastic.co/t/join-two-logs-by-common-field/65622/3 "2016-11-16T14:51:46Z")

</div>

> [@magnusbaeck](#):
>
> collate

No. They didn't come by sequence, There are many lines from other IPs and MACs. So I could depend on neither time nor number of lines.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2016, 2:51pm UTC](https://discuss.elastic.co/t/join-two-logs-by-common-field/65622/4 "2016-12-14T14:51:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.