# Repeat field extraction and aggregation
**URL:** https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558
**Category:** Logstash
**Created:** [August 5, 2022, 3:59pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558 "2022-08-05T15:59:39Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@RitzMak](https://discuss.elastic.co/u/RitzMak)
#### Post date: [August 5, 2022, 3:59pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/1 "2022-08-05T15:59:39Z")
Hello All,
I have some logs as below and I would like to get a total of all CACHE\_TIMING and DATABASE\_TIMING fields. I am thinking to create an array of these fields using gsub replacement and kv filter and then add them.
Is there a better way to accomplish this?
RANDOM CACHE\_TIMING: 10
SESSION\_LOG DATABASE\_TIMING: 8
ACRONYM CACHE\_TIMING: 6
PARM DATABASE\_TIMING: 4
UNIQUE\_SESSION\_ID DATABASE\_TIMING: 3
RANDOM DATABASE\_TIMING: 2
RANDOM CACHE\_TIMING: 1
RANDOM CACHE\_TIMING: 1
COMMIT DATABASE\_TIMING: 1
RANDOM DATABASE\_TIMING: 1
RANDOM CACHE\_TIMING: 0
RANDOM CACHE\_TIMING: 0
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 5, 2022, 4:26pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/2 "2022-08-05T16:26:58Z")
Are all those part of one event? If you use
```
output { stdout { codec => rubydebug } }
```
then what does a single event look like?
---
### Author:  [@RitzMak](https://discuss.elastic.co/u/RitzMak)
#### Post date: [August 5, 2022, 4:46pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/3 "2022-08-05T16:46:56Z")
Actual event is too large.. I have extracted other important fields and kept this timing related data into a separate field so I have to work only on a small section.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 5, 2022, 5:00pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/4 "2022-08-05T17:00:32Z")
OK, so what does that separate field look like in the rubydebug output?
---
### Author:  [@RitzMak](https://discuss.elastic.co/u/RitzMak)
#### Post date: [August 5, 2022, 5:21pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/5 "2022-08-05T17:21:37Z")
output is like below:
msg\_timing" =\> "\t\tCOMMIT DATABASE\_TIMING: 121\n\t\tPARM CACHE\_TIMING: 14\n\t\tHOLIDAY CACHE\_TIMING: 11\n\t\tDESK\_PARM\_XP CACHE\_TIMING: 10\n\t\tACRONYM CACHE\_TIMING: 9\n\t\tPARM DATABASE\_TIMING: 8\n\t\tCIRCLE DATABASE\_TIMING: 6\n\t\tBRAND\_INV\_TYPE CACHE\_TIMING: 5\n\t\tSERVICE\_STATUS DATABASE\_TIMING: 4\n\t\tCORRESPONDENT CACHE\_TIMING: 4\n\t\tV$MYSTAT DATABASE\_TIMING: 3\n\t\tGROUP\_PRICE\_LEVEL CACHE\_TIMING: 3\n\t\tWATCHLIST\_OFFERING CACHE\_TIMING: 3\n\t\tDBMS\_SESSION.UNIQUE\_SESSION\_ID DATABASE\_TIMING: 2\n\t\tPARM CACHE\_TIMING: 2\n\t\tRESULT\_FILTER CACHE\_TIMING: 2\n\t\tBRAND\_USER\_SUBTYPE CACHE\_TIMING: 1\n\t\tTRA CACHE\_TIMING: 1\n\t\tSESSION\_LOG DATABASE\_TIMING: 1\n\t\tPKG\_LOG\_SESSION.START\_LOG DATABASE\_TIMING: 1\n\t\tORDER\_CONFIG\_USER DATABASE\_TIMING: 1\n\t\tUSER\_GROUP\_FOR\_\_USER DATABASE\_TIMING: 1\n\t\tUSER\_SUBTYPE CACHE\_TIMING: 0\n\t\tDESK\_PRICING\_SOURCE CACHE\_TIMING: 0\n\t\tBOND\_ISSUE CACHE\_TIMING: 0\n\t\tBRAND CACHE\_TIMING: 0\n "
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 5, 2022, 7:20pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/6 "2022-08-05T19:20:39Z")
I would do that in a ruby filter
```
ruby {
code => '
message = event.get("message")
db = message.scan(/ DATABASE_TIMING: (\d+)/)
cache = message.scan(/ CACHE_TIMING: (\d+)/)
# This gets us
# [["121"], ["8"], ["6"], ["4"], ["3"], ["2"], ["1"], ["1"], ["1"], ["1"]]
# [["14"], ["11"], ["10"], ["9"], ["5"], ["4"], ["3"], ["3"], ["2"], ["2"], ["1"], ["1"], ["0"], ["0"], ["0"], ["0"]]
db = db.flatten # Flatten inner arrays
db = db.map(&:to_i) # Convert array entries to integers
db = db.reduce(0, :+) # Sum array entries
cache = cache.flatten
cache = cache.map(&:to_i)
cache = cache.reduce(0, :+)
event.set("totalCacheTiming", cache)
event.set("totalDatabaseTiming", db)
'
}
```
will get you
```
"totalCacheTiming" => 65,
"totalDatabaseTiming" => 148,
```
---
### Author:  [@RitzMak](https://discuss.elastic.co/u/RitzMak)
#### Post date: [August 5, 2022, 7:49pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/7 "2022-08-05T19:49:17Z")
That has worked like a charm! Thank you very much Badger.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2022, 7:49pm UTC](https://discuss.elastic.co/t/repeat-field-extraction-and-aggregation/311558/8 "2022-09-02T19:49:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.