Logstash enrichment

If aggregate does not work you could resort to ruby.