# Merge problem **URL:** \ **Category:** Logstash\ **Created:** [February 27, 2018, 9:16am UTC](https://discuss.elastic.co/t/merge-problem/121615 "2018-02-27T09:16:55Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Post date:** [February 27, 2018, 9:16am UTC](https://discuss.elastic.co/t/merge-problem/121615/1 "2018-02-27T09:16:55Z")
I can't wrap my head around how to accomplish this, but postfix logs two separate events for one email. The first event contains the from address: Feb 27 11:30:10 mail postfix/qmgr[8620]: 24C4C681F19: from=[jhon@gmail.com](mailto:jhon@gmail.com), size=8209, nrcpt=1 (queue active) Feb 27 11:30:11 mail postfix/amavis/smtp[50690]: 24C4C681F19: to=[salam@gmail.com](mailto:salam@gmail.com), relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=1.2/0.01/0/0.93, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as F3433681F7C) I want to build a search based on the from address, but do stats on the status (separate counts for deffered, sent, reject etc.). Anyway I could make splunk realize these two events are related? I need help. Thanks all ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 27, 2018, 9:17am UTC](https://discuss.elastic.co/t/merge-problem/121615/2 "2018-03-27T09:17:24Z")
Closed on March 27, 2018, 9:17am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.