# Merging 2 log lines into 1 **URL:** \ **Category:** Elasticsearch\ **Created:** [May 10, 2022, 3:28pm UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370 "2022-05-10T15:28:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![hNiven](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hniven/32/94305_2.png) [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Post date:** [May 10, 2022, 3:28pm UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370/1 "2022-05-10T15:28:58Z")
Hi, I am looking at 2 indices that have 1 field in common and then different fields. Would it be possible to merge them into 1 log line using the similar field? ![Picture1](https://us1.discourse-cdn.com/elastic/original/3X/0/9/09e7985e80f2663f56d4b7bf94269adc48d8bc43.png) Using the example above, both lines have the same value (24) in the Roll Number field, is it possible to merge them into 1 log line so that all the data comes as 1 and looks something like this: ```auto @timestamp Roll Number address name age Gender 14:23:00.000 24 Riseley Lenny 23 Other ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 10, 2022, 9:32pm UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370/2 "2022-05-10T21:32:10Z")
Generally you do this as the data is being ingested into Elasticsearch. So how are you doing that now? ---
**Author:** ![hNiven](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hniven/32/94305_2.png) [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Post date:** [May 11, 2022, 8:02am UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370/3 "2022-05-11T08:02:40Z")
Hi @warkolm Currently I have 2 separate indices (each line corresponds to a separate indices) and I am seeing if it is possible to get the current data, that is in Elasticsearch, to be combined like the example above. As you say it is possible to do this whilst the data is being ingested, but is it at all possible to combine them into 1 line when the data has already been ingested? I have seen you can create an index pattern that can include both of them, but it does not combine similar fields together and keeps the logs separate ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 11, 2022, 8:10am UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370/4 "2022-05-11T08:10:55Z")
> [@hNiven](#): > > As you say it is possible to do this whilst the data is being ingested, but is it at all possible to combine them into 1 line when the data has already been ingested? This would be a join, which Elasticsearch does not support. ---
**Author:** ![hNiven](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hniven/32/94305_2.png) [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Post date:** [May 11, 2022, 8:26am UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370/5 "2022-05-11T08:26:21Z")
Thank you for the quick responses ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 11, 2022, 8:31am UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370/6 "2022-05-11T08:31:20Z")
There's a new feature you could try if this works fr you. See [lookup runtime fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-retrieving-fields.html#lookup-runtime-fields) but as it gives the "first" hit, it might produce weird results as you are searching within the same index. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 8, 2022, 8:31am UTC](https://discuss.elastic.co/t/merging-2-log-lines-into-1/304370/7 "2022-06-08T08:31:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.