# Logstash link fileds in aggregate filter

**URL:** https://discuss.elastic.co/t/logstash-link-fileds-in-aggregate-filter/167272
**Category:** Logstash
**Created:** [February 6, 2019, 11:08am UTC](https://discuss.elastic.co/t/logstash-link-fileds-in-aggregate-filter/167272 "2019-02-06T11:08:49Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 6, 2019, 2:00pm UTC](https://discuss.elastic.co/t/logstash-link-fileds-in-aggregate-filter/167272/2 "2019-02-06T14:00:31Z")

</div>

I would use a translate filter rather than aggregate. You will need to be able to extract the country code from the phone number. There is code that can do that [here](https://github.com/googlei18n/libphonenumber). (You cannot use that directly, obviously, but it shows you all the logic required.)

Then if you have a csv (or yml, or json) that contains codes and names, like this

252,Somalia  
961,Lebanon  
51,Peru

[translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) will map it for you.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-link-fileds-in-aggregate-filter/167272)._