# Logstash-filter-aggregate

**URL:** <https://discuss.elastic.co/t/logstash-filter-aggregate/116600>\
**Category:** Logstash\
**Created:** [January 23, 2018, 6:34am UTC](https://discuss.elastic.co/t/logstash-filter-aggregate/116600 "2018-01-23T06:34:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![piingluo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/piingluo/32/26051_2.png) [@piingluo](https://discuss.elastic.co/u/piingluo)\
**Post date:** [January 23, 2018, 6:34am UTC](https://discuss.elastic.co/t/logstash-filter-aggregate/116600/1 "2018-01-23T06:34:41Z")

</div>

Hey, I was merging three event into one event, I was wondering if someone could tell me what I'm doing wrong.  
input example:

```auto
type=SYSCALL msg=audit(1516094800.649:1198): arch=c000003e syscall=59 success=yes exit=0 a0=280b5 e0 a1=27f3c20 a2=280a790 a3=7fffad05f830 items=2 ppid=3989 pid=10878 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=9 comm="ls" exe="/usr/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="SYSCALL_exec"
type=EXECVE msg=audit(1516094800.649:1198): argc=2 a0="ls" a1="--color=auto"
type=CWD msg=audit(1516094800.649:1198): cwd="/home/user1"

```

filter example:

```auto
filter {
          grok {  
            match => { "message" => ["type=%{DATA:audit_type}\smsg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\): (?<sub_message>.*)"]}
          }   
          if [audit_type] == "SYSCALL" {
              aggregate {
                  task_id => "%{audit_counter}"
                  code => "map['msg'] = event.get('sub_message')"
                  map_action => "create"
              }   
          }   
          if [audit_type] == "EXECVE" {
              aggregate {
                 task_id => "%{audit_counter}"
                 code => "map['args'] = event.get('sub_message')"
                  map_action => "create"
              }   
          }   
          if [audit_type] == "CWD" {
              aggregate {
                  task_id => "%{audit_counter}"
                  code => "map['cwd'] = event.get('sub_message');event['msg'] = map['msg']; event['args'] = map['args']; event['cwd'] = map['cwd']" 
                  #code => "event.set('msg', map['msg']); event.set('args',map['args'])" 
                  map_action => "create"
                  end_of_task => true
                  timeout => 60
              }
          }
 }

```

i expect the output like this，but it's not working

```auto
msg =>"arch=c000003e syscall=59 success=yes exit=0 a0=280b5 e0 a1=27f3c20 a2=280a790 a3=7fffad05f830 items=2 ppid=3989 pid=10878 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=9 comm=\"ls\" exe=\"/usr/bin/ls\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"SYSCALL_exec\""
args =>"argc=2 a0=\"ls\" a1=\"--color=auto\""
cwd =>"cwd=\"/home/lp306b\""

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2018, 6:34am UTC](https://discuss.elastic.co/t/logstash-filter-aggregate/116600/2 "2018-02-20T06:34:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.