# Logstash aggregate not working as expected

**URL:** https://discuss.elastic.co/t/logstash-aggregate-not-working-as-expected/280943
**Category:** Logstash
**Created:** [August 10, 2021, 3:31pm UTC](https://discuss.elastic.co/t/logstash-aggregate-not-working-as-expected/280943 "2021-08-10T15:31:57Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![emad101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emad101/32/82338_2.png) [@emad101](https://discuss.elastic.co/u/emad101)
#### Post date: [August 10, 2021, 3:31pm UTC](https://discuss.elastic.co/t/logstash-aggregate-not-working-as-expected/280943/1 "2021-08-10T15:31:58Z")

</div>

Hello,  
I am trying to send an entire txt file line in one single field to elastic. I am trying to do this using logstash aggregate, but it seems that it is no longer working, each line is being sent as a separate field rather than just one field for the entire file.

Here is the logstach filter that we are using

```auto
filter {
  aggregate {
    task_id => "%{app.code}"
    code => '
      map["full_message"] ||= ""
      map["full_message"] << (event.get("message") + "\n")
      event.cancel()
    '
    push_previous_map_as_event => true
    timeout => 60
  }
}

```

with the following logstash.yml configuration

```auto
pipeline.batch.size: 125
pipeline.batch.delay: 5
pipeline.workers: 1
http.host: "0.0.0.0"
http.port: 9600
#path.config: "/etc/logstash/conf.d/default-pipeline.conf"
path.data: "/app/logstash/data"
queue.type: persisted

```

The logstash version we are using is 7.9.1

Any advice on what we are doing wrong?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2021, 3:32pm UTC](https://discuss.elastic.co/t/logstash-aggregate-not-working-as-expected/280943/2 "2021-09-07T15:32:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
