# Update document and concatenate field with Logstash

**URL:** https://discuss.elastic.co/t/update-document-and-concatenate-field-with-logstash/357642
**Category:** Logstash
**Created:** [April 17, 2024, 4:07pm UTC](https://discuss.elastic.co/t/update-document-and-concatenate-field-with-logstash/357642 "2024-04-17T16:07:07Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![CDBSSG](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@CDBSSG](https://discuss.elastic.co/u/CDBSSG)
#### Post date: [April 17, 2024, 4:07pm UTC](https://discuss.elastic.co/t/update-document-and-concatenate-field-with-logstash/357642/1 "2024-04-17T16:07:07Z")

</div>

Hello,

We would like to update a document using Logstash but one of our field should be concatenante and not replace by the new one.

Example, if we have two lines to insert :

```auto
{"state" => "created", "data" => "firstData"}
{"state" => "sent", "data" => "SecondData"}

```

Actually the result is :

```auto
"_id" => 1
"version" => 2
"state" => "sent"
"data" => "SecondData"

```

The wished result is :

```auto
"_id" => 1
"version" => 2
"state" => "sent"
"data" => "FirstData, SecondData"

```

How can we perform this kind of update ?

**Elasticsearch version** :  
7.16

Regards,  
Thomas

---

<div class="post-metadata">

### Author: ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [April 17, 2024, 9:02pm UTC](https://discuss.elastic.co/t/update-document-and-concatenate-field-with-logstash/357642/2 "2024-04-17T21:02:14Z")

</div>

logstash treat these as two separate event.  
in my view you can't do what you like unless you sent them as one event.