# Logstash parser **URL:** \ **Category:** Logstash\ **Created:** [June 6, 2019, 6:01pm UTC](https://discuss.elastic.co/t/logstash-parser/184642 "2019-06-06T18:01:39Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![vinu89](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinu89/32/45939_2.png) [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Post date:** [June 6, 2019, 6:01pm UTC](https://discuss.elastic.co/t/logstash-parser/184642/1 "2019-06-06T18:01:39Z")
Hi can someone help me to write the parser for this below logs Message 335881139 enqueued on incoming connection (ICID 0) from [xyz@xyz.com](mailto:xyz@xyz.com) to [xyz@xyz.com](mailto:xyz@xyz.com) Message 335881139 scanned by Malware Protection engine.MALICIOUS. I have two different logs which says that [xyz@xyz.com](mailto:xyz@xyz.com) has sent the malicious mail... is there any possibility to compare this two logs and get the result that the particular user has sent me the malicious mail..Message id is common for both the logs.. I can write the parser for this logs seperately but don't know how to compare and achieve my result... Please help ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 6, 2019, 6:06pm UTC](https://discuss.elastic.co/t/logstash-parser/184642/2 "2019-06-06T18:06:19Z")
You could combine them using an [aggregate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html) filter. ---
**Author:** ![vinu89](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinu89/32/45939_2.png) [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Post date:** [June 6, 2019, 6:54pm UTC](https://discuss.elastic.co/t/logstash-parser/184642/3 "2019-06-06T18:54:42Z")
Hi I tried this but I couldn't understand them please explain ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2019, 6:54pm UTC](https://discuss.elastic.co/t/logstash-parser/184642/4 "2019-07-04T18:54:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.