# Multiple Labels for same field for SNMP
**URL:** https://discuss.elastic.co/t/multiple-labels-for-same-field-for-snmp/375642
**Category:** Logstash
**Created:** [March 10, 2025, 10:24am UTC](https://discuss.elastic.co/t/multiple-labels-for-same-field-for-snmp/375642 "2025-03-10T10:24:17Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Sohaib\_Khan](https://discuss.elastic.co/u/Sohaib_Khan)
#### Post date: [March 10, 2025, 10:24am UTC](https://discuss.elastic.co/t/multiple-labels-for-same-field-for-snmp/375642/1 "2025-03-10T10:24:17Z")
Hi,
I'm using SNMP-Logstash plugin to get data from SNMP. It works fine to an extent, The issues comes in for a field that has multiple values, example "processorusage" as i have 2 fortigate devices but it is fetching all these fields in single document. There are other fields like this having same issue. I'm attaching the screenshots for both cases, It would be great if there's some way to merge them into one single label or anything I'm missing on please do let me know.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 10, 2025, 2:08pm UTC](https://discuss.elastic.co/t/multiple-labels-for-same-field-for-snmp/375642/2 "2025-03-10T14:08:01Z")
It's showing you per-CPU utilization. How do you want to combine them? Average?
Note that you may only want to combine processors of the same type (e.g. do not average NP, SP, and CP utilization).
---
### Author:  [@Sohaib\_Khan](https://discuss.elastic.co/u/Sohaib_Khan)
#### Post date: [March 23, 2025, 10:46am UTC](https://discuss.elastic.co/t/multiple-labels-for-same-field-for-snmp/375642/3 "2025-03-23T10:46:23Z")
I don't understand how it showing per CPU utilization. I have two Fortinet devices and both are coming in the same document. There shouldn't be this many fields for two devices. How could i combine them i a single document with respect to their device.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 23, 2025, 1:57pm UTC](https://discuss.elastic.co/t/multiple-labels-for-same-field-for-snmp/375642/4 "2025-03-23T13:57:22Z")
See [this](https://discuss.elastic.co/t/custom-logstash-snmp-plugin-pipeline-approach/251901/2) post. It links to a couple of posts with ideas about how to split an SNMP response that covers multiple devices.
As I said, you could average the CPU cores on a device, but you may not want to take averages across different core types. This averaging would require further ruby code, but depending on the final data structure you end up with you may be able to do it in elasticsearch when retrieving the data.