# Logstash - aggregate messages - start with new line

**URL:** https://discuss.elastic.co/t/logstash-aggregate-messages-start-with-new-line/202920
**Category:** Logstash
**Created:** [October 9, 2019, 11:19pm UTC](https://discuss.elastic.co/t/logstash-aggregate-messages-start-with-new-line/202920 "2019-10-09T23:19:17Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Vincent\_Chen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vincent_chen/32/43352_2.png) [@Vincent\_Chen](https://discuss.elastic.co/u/Vincent_Chen)
#### Post date: [October 9, 2019, 11:19pm UTC](https://discuss.elastic.co/t/logstash-aggregate-messages-start-with-new-line/202920/1 "2019-10-09T23:19:17Z")

</div>

Hi everyone,

I am trying to aggregate events related to the same transaction. The aggregate part works fine, I am able to merge all related events into the same field. But I want each event to be placed at a newline.

See my aggregate filter:

```
aggregate {
      task_id => "%{thread}"
      code => "map['new_msg'] << '\n'; map['new_msg'] << event.get('message'); event.set('new_msg', map['new_msg'])"
      map_action => "update"
      end_of_task => true
      timeout => 360
    }

```

This is what my field looks like:

> message1\nmessage2\nmessage3\n

This is what I want them to be:

> message1  
> message2  
> message3

Could anyone please help.

Cheers,  
Vincent

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 9, 2019, 11:34pm UTC](https://discuss.elastic.co/t/logstash-aggregate-messages-start-with-new-line/202920/2 "2019-10-09T23:34:12Z")

</div>

Can you explain what you want the event to look like as either JSON or rubydebug output?

---

<div class="post-metadata">

### Author: ![Vincent\_Chen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vincent_chen/32/43352_2.png) [@Vincent\_Chen](https://discuss.elastic.co/u/Vincent_Chen)
#### Post date: [October 10, 2019, 12:56am UTC](https://discuss.elastic.co/t/logstash-aggregate-messages-start-with-new-line/202920/3 "2019-10-10T00:56:01Z")

</div>

Hi @Badger  
We want that to be json format. So that when searching from Kibana, we can see the message field is actually multiple line. Rather than one event after another.

Cheers,  
Vincent

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 10, 2019, 12:49pm UTC](https://discuss.elastic.co/t/logstash-aggregate-messages-start-with-new-line/202920/4 "2019-10-10T12:49:46Z")

</div>

OK, I'll take that as "no".

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 7, 2019, 12:49pm UTC](https://discuss.elastic.co/t/logstash-aggregate-messages-start-with-new-line/202920/5 "2019-11-07T12:49:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.