# Sum with unique object
**URL:** https://discuss.elastic.co/t/sum-with-unique-object/225425
**Category:** Logstash
**Created:** [March 27, 2020, 2:46pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425 "2020-03-27T14:46:56Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [March 27, 2020, 2:46pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/1 "2020-03-27T14:46:56Z")
For example if i have csv file with fields;
Car, parking,date of entry
V1, p1, 12-03-2020 12:30
V1, p1, 12-03-2020 11:30
V2, p2,12-03-2020 10:30
V2, p2,12-03-2020 10:45
How can i calculate number of time V1 enter to p1? And the same thing for the other cars ?
Please à y ideas can helps me !
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 27, 2020, 3:39pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/2 "2020-03-27T15:39:30Z")
Use an aggregate filter.
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [March 27, 2020, 6:36pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/3 "2020-03-27T18:36:25Z")
Thanks for the quick response, I tried with this code, it works
aggregate {
task\_id =\> "%{Car}"
code =\> " map['sum'] ||= 0
map['sum'] += 1
event.cancel"
push\_map\_as\_event\_on\_timeout =\> true
timeout\_task\_id\_field =\> "Car"
timeout =\> 10
}
my problem now is that this code eliminates the other columns for example date of entry of each car.
so how can I leave the other data related to each car and just add in new column the number of times it enter to this parking
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 27, 2020, 7:17pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/4 "2020-03-27T19:17:29Z")
If there are additional columns you want to add to the event then add them to the map.
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [March 27, 2020, 7:55pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/5 "2020-03-27T19:55:47Z")
OK, I added the other columns but I have a question why it does not display all the entry dates for each car just it takes only one entry date for each car ?? ??
is there another method to leave all the data like in my csv file and just add a column which calculates the sum ??
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 27, 2020, 11:25pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/6 "2020-03-27T23:25:44Z")
Well, event.cancel is optional. If you remove that you will get all the original events as well as events with the aggregated data.
Alternatively, for each value of the task id create an array, and add the event hash to it
```
a ||= []
a << event.to_hash
```
then split the array into separate events using a split filter once the aggregation is done.
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [March 28, 2020, 4:47pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/7 "2020-03-28T16:47:26Z")
Thank you so much for your help; really i appreciate that.
I understood correctly and I tried to do everything, finally the initial data is stored separately and the aggregated data in sequence is stored with sum
my last question is can I eliminate @timestamp and @version in aggregated data?how can i added to this code?
aggregate {
task\_id =\> "%{Car}"
code =\> "map['Car'] ||= []
map['Car\_registration'] \<\< {'Car' =\> event.get('Car')}
map['sum'] ||= 0
map['sum'] += 1
"
push\_map\_as\_event\_on\_timeout =\> true
timeout\_task\_id\_field =\> "Car"
timeout =\> 5
}
split {
field =\> "Car"
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 28, 2020, 5:41pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/8 "2020-03-28T17:41:49Z")
> [@Emna1](#):
>
> my last question is can I eliminate @timestamp and @version in aggregated data?
I don't think those field are optional, but you could try
```
mutate { remove_field => ["@timestamp", "@version"] }
```
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [March 28, 2020, 5:57pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/9 "2020-03-28T17:57:54Z")
It works ,Thank's you are so helpful 😉
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [April 2, 2020, 1:35pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/10 "2020-04-02T13:35:18Z")
can i ask one more question please !!
for each csv file it calculates the number of times that car uses this parking but when I add another file it calculates the same thing separetly ..
if I recover the files in real time and i want for each time when I add a file i want him to calculate sum together.
Any help ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 2, 2020, 3:08pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/11 "2020-04-02T15:08:47Z")
The aggregate filter will only aggregate data that arrives within the timeout. Extending the timeout may help. Otherwise I think you would need to aggregate the aggregates in elasticsearch.
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [April 2, 2020, 3:19pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/12 "2020-04-02T15:19:44Z")
I think extension of timeout will not help me because I received the files every dayd but the second solution aggregate the aggregates how can i do that, i want to try, can you explicate more!!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 2, 2020, 3:22pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/13 "2020-04-02T15:22:46Z")
That is really an elasticsearch question.
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [April 4, 2020, 9:54am UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/14 "2020-04-04T09:54:56Z")
Hi @Badger , i see this topic [Extract Month and Year from date field](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/4)
So, I have the same trouble and i want a new field contain for example 2020-02
i try this code
grok { match =\> { "Date\_of\_entry" =\> "^%{YEAR:year}-%{MONTHNUM}" } }
but he extract just the month so what shoud i add to this code to get result like this 2020-02?
can you answer me please?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 4, 2020, 2:22pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/15 "2020-04-04T14:22:53Z")
> [@Emna1](#):
>
> grok { match =\> { "Date\_of\_entry" =\> "^%{YEAR:year}-%{MONTHNUM}" } }
I would expect that to extract the year into [year]. It would not extract the month, but it would fail to match if the month was not present. If you want both year and month in a single field you could use
```
pattern_definitions => { "YM" => "%{YEAR}-%{MONTHNUM}" }
match => { "message" => "^%{YM:yearAndMonth}" }
```
---
### Author:  [@Emna1](https://discuss.elastic.co/u/Emna1)
#### Post date: [April 4, 2020, 5:09pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/16 "2020-04-04T17:09:49Z")
So beautiful!! it works, thank you so much 😍 😍 💓
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 2, 2020, 5:10pm UTC](https://discuss.elastic.co/t/sum-with-unique-object/225425/17 "2020-05-02T17:10:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.