# Logstash filter, how to find first and last log?

**URL:** <https://discuss.elastic.co/t/logstash-filter-how-to-find-first-and-last-log/147037>\
**Category:** Logstash\
**Created:** [September 3, 2018, 8:51am UTC](https://discuss.elastic.co/t/logstash-filter-how-to-find-first-and-last-log/147037 "2018-09-03T08:51:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zxc654951](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zxc654951](https://discuss.elastic.co/u/zxc654951)\
**Post date:** [September 3, 2018, 8:51am UTC](https://discuss.elastic.co/t/logstash-filter-how-to-find-first-and-last-log/147037/1 "2018-09-03T08:51:56Z")

</div>

Hi,

I have some log with timestamp, keyID, message, or more. Those logs don't have start\_tag and end\_tag, however messages don't. Can I use mutate filter find the first and last log by keyID(machineID)?  
Below are some my log.

```
{ "LogDateTime":"2018-08-29 17:14:15.542882", "LogLevel":"info", "Message":"S", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.543613", "LogLevel":"info", "Message":"80<E>", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.543679", "LogLevel":"info", "Message":"Len:5|38-30-3C-45-3E", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.547011", "LogLevel":"info", "Message":"Len:15|38-31-3C-72-63-3D-34-3E-30-30-30-30-3C-45-3E", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.547046", "LogLevel":"info", "Message":"81<rc=4>0000<E>", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.628773", "LogLevel":"info", "Message":"E", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.637684", "LogLevel":"warning", "Message":"SSL_get_error:5", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.637725", "LogLevel":"warning", "Message":"errno:0", "keyID":"65dcea76" }
{ "LogDateTime":"2018-08-29 17:14:15.637785", "LogLevel":"warning", "Message":"MainStatusMachine::ReadClientMessage runtime_error", "keyID":"65dcea76" }

```

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2018, 8:52am UTC](https://discuss.elastic.co/t/logstash-filter-how-to-find-first-and-last-log/147037/2 "2018-10-01T08:52:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.