.+)'" }
}
if "end" in [tags]{
aggregate {
task\_id =\> "%{source}"
code =\> "event.set('build\_DefinitionName', '%{build\_DefinitionName}')
event.set('key', 'value')
map['build\_DefinitionName'] ||= event.get('build\_DefinitionName')
event.set('build\_BuildNumber', map['build\_BuildNumber'])
event.set('build\_RequesterName', map['build\_RequesterName'])
event.set('build\_TeamProject', map['build\_TeamProject'])
event.set('build\_IsFailed', map['build\_IsFailed'])
event.set('build\_ErrorMessage', map['build\_ErrorMessage'])"
map\_action =\> "create\_or\_update"
push\_previous\_map\_as\_event =\> true
end\_of\_task =\> false
}
}
if "first" not in [tags] and "end" not in [tags] {
drop { }
}
mutate {
remove\_field =\> ["message"]
}
mutate {
remove\_tag =\> ["first"]
}
}
output {
elasticsearch {
hosts =\> ["elasticsearch:9200"]
index =\> "mylog-%{+YYYY.MM.dd}"
}
stdout { codec =\> rubydebug }
}
Here whenever log matches the above one of the grok then it will create that field and puts in elasticsearch as a separate event. So what we wanted is when the last grok match happened then it should pull fields from previous events and put it as a single event using source as a common filed. How to achieve this?
The above config results in kibana like below, where we don;t have any value for fileds like build\_DefinitionName, build\_TeamProject etc in the final event,
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [September 4, 2018, 8:21am UTC](https://discuss.elastic.co/t/logstash-getting-fileds-from-another-event/146865/2 "2018-09-04T08:21:17Z")
Hi,
First, some remarks :
- `%{build_DefinitionName}` syntax does not work in `code`. You should use `event.get('build_DefinitionName')`.
- `map` object is not auto-filled. It must be filled for yourself, each time you have a "first" event with `map['field'] = event.get['field']`
- `push_previous_map_as_event` is especially useful when you have no "tagged" end event and events are not interlaced. It has been thought primarily for jdbc input case. In your case, it seems that you have an tagged end event. And as you speak about log and metrics, you will probably receive interlaced events, I mean first event with source "source1", then event with source "source2", then again event with "source1". `push_previous_map_as_event` requires events are sorted per task\_id.
- `end_of_task => true` is useful to destroy `map` object (associated to task\_id) when you don't need it anymore. It is important so that maps are not stacked in memory forever.
- finally, if you want that "first" event fields are merged into "end" event, you must not use `push*` aggregate options, that always create a fresh new event using `map` object.
That said, so that "first" event fields are merged into "end" event, I suggest this Logstash aggregate configuration :
```
if "first" in [tags] {
aggregate {
task_id => "%{source}"
code => "
map['build_DefinitionName'] = event.get('build_DefinitionName') unless event.get('build_DefinitionName').nil?
map['build_RequesterName'] = event.get('build_RequesterName') unless event.get('build_RequesterName').nil?
map['build_BuildNumber'] = event.get('build_BuildNumber') unless event.get('build_BuildNumber').nil?
map['build_TeamProject'] = event.get('build_TeamProject') unless event.get('build_TeamProject').nil?
map['build_ErrorMessage'] = event.get('build_ErrorMessage') unless event.get('build_ErrorMessage').nil?
"
}
}
if "end" in [tags] {
aggregate {
task_id => "%{source}"
code => "
event.set('build_DefinitionName', map['build_DefinitionName'])
event.set('build_RequesterName', map['build_RequesterName'])
event.set('build_BuildNumber', map['build_BuildNumber'])
event.set('build_TeamProject', map['build_TeamProject'])
event.set('build_ErrorMessage', map['build_ErrorMessage'])
"
end_of_task => true
}
}
```
---
### Author:  [@vasudevan](https://discuss.elastic.co/u/vasudevan)
#### Post date: [September 4, 2018, 10:31am UTC](https://discuss.elastic.co/t/logstash-getting-fileds-from-another-event/146865/3 "2018-09-04T10:31:56Z")
Yes this serves the purpose. Now we will go ahead and implement the ELK monitoring stuff across our organization.
Thanks a lot
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [September 4, 2018, 1:10pm UTC](https://discuss.elastic.co/t/logstash-getting-fileds-from-another-event/146865/4 "2018-09-04T13:10:36Z")
Nice !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 2, 2018, 1:10pm UTC](https://discuss.elastic.co/t/logstash-getting-fileds-from-another-event/146865/5 "2018-10-02T13:10:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.