# Problem to copy a field from one event to another event **URL:** \ **Category:** Logstash\ **Created:** [March 12, 2018, 10:05am UTC](https://discuss.elastic.co/t/problem-to-copy-a-field-from-one-event-to-another-event/123522 "2018-03-12T10:05:13Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Post date:** [March 12, 2018, 10:05am UTC](https://discuss.elastic.co/t/problem-to-copy-a-field-from-one-event-to-another-event/123522/1 "2018-03-12T10:05:13Z")
Two event's of postfix-mail log fields are below.: source: /var/log/mail.log **postfix\_queueid:24C4C681F19** host: mail **program: postfix/amavis/smtp** postfix\_to: [jhon@gmail.com](mailto:jhon@gmail.com) time: 10:53:30 postfix\_status: sent postfix\_delay: 2.1 postfix\_relay\_ip: 127.0.0.1 postfix\_delay\_in\_qmgr: 0.01 source: /var/log/mail.log **postfix\_queueid: 24C4C681F19** postfix\_size: 8209 host: mail time: 10:53:30 **program: postfix/qmgr** **postfix\_from: [salam@gmail.com](mailto:salam@gmail.com)** I want to copy a field postfix\_from of program:postfix/qmgr To program:postfix/amavis/smtp if their both postfix\_queueid is same. otherwise no copy I need a complete information. like from, to, status etc in kibana dashboard. ![khsjkd](https://us1.discourse-cdn.com/elastic/original/3X/4/0/404f9bd5b8b053292a67a55a2de778ba41e5510f.JPG) Thanks all ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [March 12, 2018, 11:57am UTC](https://discuss.elastic.co/t/problem-to-copy-a-field-from-one-event-to-another-event/123522/2 "2018-03-12T11:57:09Z")
As far as I know this cannot be done in logstash. You want to combine events that match the postfix\_id. In order to accomplish this you need to temporarily store your events and query those while processing event and if you have a match push them to elasticsearch. Pushing the temp data to ES will not help as you will always have a lag between storing the data and when the data is available for your next query. This lag results in a failed query inside your filter part. You can do a update on an existing document if you use the postfix\_id as document id for example but you will get very poor performance results if you go that way. You might be better of into looking into filebeat for this where you can apply a multi-line filter in side filbeat or make sure postfix only sends 1 log line per event.. ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [March 12, 2018, 12:07pm UTC](https://discuss.elastic.co/t/problem-to-copy-a-field-from-one-event-to-another-event/123522/3 "2018-03-12T12:07:15Z")
There might be way to do what you need using other means. Have a read [- here -](http://www.tipstuff.org/2014/01/Postfix-log-centralize-and-analysis-in-realtime-with-fluentd-elasticsearch-and-kibana-part-2.html?rndad=3576626312-1520856186) this might provide what you are looking for. (full disclaimer, I do not support that nor do I have any knowlage about it) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 9, 2018, 12:07pm UTC](https://discuss.elastic.co/t/problem-to-copy-a-field-from-one-event-to-another-event/123522/4 "2018-04-09T12:07:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.