# Logstash-data between start and end transaction

**URL:** <https://discuss.elastic.co/t/logstash-data-between-start-and-end-transaction/143735>\
**Category:** Logstash\
**Created:** [August 9, 2018, 5:10pm UTC](https://discuss.elastic.co/t/logstash-data-between-start-and-end-transaction/143735 "2018-08-09T17:10:32Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2018, 5:57pm UTC](https://discuss.elastic.co/t/logstash-data-between-start-and-end-transaction/143735/2 "2018-08-09T17:57:18Z")

</div>

Providing the lines for different transactions are never interleaved you can do it using an aggregate filter and a class variable. Note that you must set --pipeline.workers 1 to use an aggregate. Your use case matches [example 1](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example1) in the aggregate documentation, except you are missing the taskid on some lines. So use a class variable to add it.

```
    if [message] =~ /TRANSACTION START/ {
        grok { match => { "message" => "TRANSACTION START \[%{NUMBER:taskid}\]" } }
        ruby { code => '@@taskid = event.get("taskid") ' }
    } else {
        ruby { code => 'event.set("taskid", @@taskid)' }
    }

```

Then do the aggregate using task\_id =\> "%{taskid}"

---

_[View the full topic](https://discuss.elastic.co/t/logstash-data-between-start-and-end-transaction/143735)._