# Join various WinLogBeat Windows Event Log events into one? **URL:** \ **Category:** Logstash\ **Created:** [March 12, 2021, 1:44pm UTC](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095 "2021-03-12T13:44:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [March 12, 2021, 1:44pm UTC](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095/1 "2021-03-12T13:44:27Z")
Hello Using WinLogBeat, Im collecting logs from Windows Event Logs and sending it to Logstash which then sends it to Elasticsearch. For all, working. Issue is that I want to do something a bit more complex... Lets say I have the following ID DateTime User Data1 Data2 Data 3 sourceoflog 1 2021-03-12:14:01 auser 192.168.9.1security 2 2021-03-12:14:02 auser failed operation 3 2021-03-12:14:03 auser notfound application As you can see, the common field would be "user"; Id like to join all this data and store it in one index, elimating somethings I dont want. For example, it would end up something like DateTime User OutCome Reason Source 2021-03-12:14:01 auser notfound 192.168.9.1 As you can see, I have added various data together using a "primary key" as auser and then seperated it to a standalone index. In SQL, it would be just looking against various tables but, I dont know how to do it here. What would be the best way? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 12, 2021, 3:52pm UTC](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095/2 "2021-03-12T15:52:31Z")
> [@riahc3](#): > > What would be the best way? Use an aggregate filter. Take a look at [example 3](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3). Make sure you understand the restrictions (pipeline.workers 1, pipeline.ordered). ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [March 15, 2021, 8:28am UTC](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095/3 "2021-03-15T08:28:01Z")
Doesnt look to be that simple though Cant seem to edit my post (beyond me) but one of the entries I need as "domain\auser" so I need to split that. ID DateTime User Data1 Data2 Data 3 sourceoflog 1 2021-03-12:14:01 auser 192.168.9.1security 2 2021-03-12:14:02 domain\auser failed operation 3 2021-03-12:14:03 auser notfound application Like so. I dont quite understand example 3 ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [March 18, 2021, 2:41pm UTC](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095/4 "2021-03-18T14:41:52Z")
Any examples on how to do this? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 15, 2021, 2:42pm UTC](https://discuss.elastic.co/t/join-various-winlogbeat-windows-event-log-events-into-one/267095/5 "2021-04-15T14:42:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.