# SEQUENTIAL FIELD WHEN MATCH ID DOC

**URL:** https://discuss.elastic.co/t/sequential-field-when-match-id-doc/245196
**Category:** Logstash
**Created:** [August 17, 2020, 8:32am UTC](https://discuss.elastic.co/t/sequential-field-when-match-id-doc/245196 "2020-08-17T08:32:33Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Daniel\_Lopez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_lopez/32/50639_2.png) [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)
#### Post date: [August 17, 2020, 8:32am UTC](https://discuss.elastic.co/t/sequential-field-when-match-id-doc/245196/1 "2020-08-17T08:32:33Z")

</div>

Hi

I will try to explain what I'm in

I have these lines in a log

ID:1,PID:123, Path:\123\123

ID:2,PID:234, Path:\234\234

ID:1,PID:345, Path:\345\345

The result of indexed doc I need to get

\_Id: 1  
PID0:123  
Path0:\123\123  
PID1:345  
Path1:\345\345

\_Id: 2  
PID0:234  
Path0:\234\234

If this possible? make a sequential name field from new data? PID0, PID1, PID2, PID3, Path0, Path1,Path2....

Thanks! 😃

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 17, 2020, 2:27pm UTC](https://discuss.elastic.co/t/sequential-field-when-match-id-doc/245196/2 "2020-08-17T14:27:36Z")

</div>

You could do that with an aggregate filter.Accumulate PID and Path into arrays, then after a timeout iterate over the arrays in ruby and add fields to the event.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2020, 2:28pm UTC](https://discuss.elastic.co/t/sequential-field-when-match-id-doc/245196/3 "2020-09-14T14:28:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
