# Logstash Aggregation Plugin
**URL:** https://discuss.elastic.co/t/logstash-aggregation-plugin/184632
**Category:** Logstash
**Created:** [June 6, 2019, 4:50pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632 "2019-06-06T16:50:00Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [June 6, 2019, 4:50pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632/1 "2019-06-06T16:50:00Z")
We are getting multiple events come in ( because of multiple botnet calls, but it is the same SRC and DST) How do you use the aggregation plugin to combine it all into 1 . Timestamps are slightly different
```
Time src dhost dst requestMethod request act outcome reason riskScore requestContext
June 2nd 2019, 1.2.3.4 62.212.33.98 62.212.33.98 CONNECT 62.212.33.98/ Blocked 403 Reputation block outbound request: botnet site 0 None
June 2nd 2019, 1.2.3.4 62.212.33.98 62.212.33.98 CONNECT 62.212.33.98/ Blocked 403 Reputation block outbound request: botnet site 0 None
June 2nd 2019, 1.2.3.4 62.212.33.98 62.212.33.98 CONNECT 62.212.33.98/ Blocked 403 Reputation block outbound request: botnet site 0 None
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 6, 2019, 5:28pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632/2 "2019-06-06T17:28:44Z")
What do you want to aggregate?
---
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [June 6, 2019, 6:07pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632/3 "2019-06-06T18:07:29Z")
"src" and "dst" and "request"
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 6, 2019, 6:57pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632/4 "2019-06-06T18:57:56Z")
Those three fields have the same values in those three messages. It does not make any sense to aggregate them.
---
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [June 6, 2019, 6:58pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632/5 "2019-06-06T18:58:59Z")
Thats the problem, We get multiple events from zscaler for the same thing that happened . Thats why im trying to condense it into 1 document
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 6, 2019, 7:04pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632/6 "2019-06-06T19:04:24Z")
It sounds like you want to do de-duplication. If you are using an elasticsearch output then [this](https://www.elastic.co/blog/logstash-lessons-handling-duplicates) blog has some ideas.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2019, 7:04pm UTC](https://discuss.elastic.co/t/logstash-aggregation-plugin/184632/7 "2019-07-04T19:04:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.