# Logstash JSON conversion can we control

**URL:** https://discuss.elastic.co/t/logstash-json-conversion-can-we-control/107379
**Category:** Logstash
**Created:** [November 13, 2017, 11:49am UTC](https://discuss.elastic.co/t/logstash-json-conversion-can-we-control/107379 "2017-11-13T11:49:47Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![Shekhar\_Pandey](https://avatars.discourse-cdn.com/v4/letter/s/7ab992/32.png) [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)
#### Post date: [November 14, 2017, 7:45am UTC](https://discuss.elastic.co/t/logstash-json-conversion-can-we-control/107379/4 "2017-11-14T07:45:00Z")

</div>

Hi Krishna!

I follow the filter topic...but some where I stuck....I given full error details in the below link...

Kindly see [Logstash Aggregate plugin](https://discuss.elastic.co/t/logstash-aggregate-plugin/107501)

And same here also..  
This example from elastic documentation:  
Given that you have this SQL query : SELECT country\_name, town\_name FROM town

{ "country\_name": "France", "town\_name": "Paris" }  
{ "country\_name": "France", "town\_name": "Marseille" }  
{ "country\_name": "USA", "town\_name": "New-York" }

And you would like these 2 result events to push them into elasticsearch :  
{ "country\_name": "France", "towns": [{"town\_name": "Paris"}, {"town\_name": "Marseille"}] }  
{ "country\_name": "USA", "towns": [{"town\_name": "New-York"}] }

They mention we have to follow this filter  
You can do that using push\_previous\_map\_as\_event aggregate plugin option :  
filter {  
aggregate {  
task\_id =\> "%{country\_name}"  
code =\> "  
map['country\_name'] = event.get('country\_name')  
map['towns'] ||= []  
map['towns'] \<\< {'town\_name' =\> event.get('town\_name')}  
event.cancel()  
"  
push\_previous\_map\_as\_event =\> true  
timeout =\> 3  
}  
}

And with respect to above filter...I have sql query like this..  
Select pid, fsid, title, brand from table1;  
But I don't want to aggregate it...but I want to put all the above fields inside of one another name like Shekhar...

So ..I used the following method...  
filter {  
aggregate {  
task\_id =\> "%{id}"  
code =\> "

```
 map['shekhar'] ||= []
 map['shekhar'] << {'brand' => event.get('brand')}
map['shekhar'] << {'pid' => event.get('pid')}
map['shekhar'] << {'title' => event.get('title')}

```

map['shekhar'] \<\< {'brand\_id' =\> event.get('brand\_id')}  
event.cancel()  
"  
push\_previous\_map\_as\_event =\> true  
timeout =\> 3  
}  
}

I got output as I want all fields inside of the shekhar[].....but only one output showing because of aggregation....it showing last value....so how I can edit the above filter to get all the documents.....

Thank you.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-json-conversion-can-we-control/107379)._