# Using aggregate to add modsecurity data to previous event

**URL:** <https://discuss.elastic.co/t/using-aggregate-to-add-modsecurity-data-to-previous-event/326423>\
**Category:** Logstash\
**Created:** [February 24, 2023, 10:37am UTC](https://discuss.elastic.co/t/using-aggregate-to-add-modsecurity-data-to-previous-event/326423 "2023-02-24T10:37:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![admin\_berlin](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@admin\_berlin](https://discuss.elastic.co/u/admin_berlin)\
**Post date:** [February 24, 2023, 10:37am UTC](https://discuss.elastic.co/t/using-aggregate-to-add-modsecurity-data-to-previous-event/326423/1 "2023-02-24T10:37:10Z")

</div>

Hi, I have a modsec logfile that looks like this:

```auto
--8afa774c-A--
[24/Feb/2023:04:34:53 +0100] Y-WoWiTsAtEsT123 12.139.152.111 14327 10.29.14.193 8080
--8afa774c-B--
POST /its/a/test/dude HTTP/1.1
Host: www.my-site.de
Content-Type: text/plain
Origin: https://www.my-site.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1
Referer: https://www.my-site.com/
Content-Length: 129
Accept-Language: de-DE,de;q=0.9
X-Forwarded-For: 123.123.123.123
WL-Proxy-Client-IP: 123.123.123.123
Cookie: BIGipServerpool_pfe_https=!WoWiTsAtEsT123=; jsessionid=WoWiTsAtEsT123-WoWiTsAtEsT123-WoWiTsAtEsT123-WoWiTsAtEsT123!WoWiTsAtEsT123!8001!-1!-123123123!WoWiTsAtEsT123!8001!-1

--8afa774c-C--
data..

--8afa774c-F--
data..

--8afa774c-H--
data..

--8afa774c-Z--

```

We cannot use the JSON format for ModSecurity. Is there a way to combine this data with the respective header in logstash(--8afa774c-A--)?

We would like the following format:

```auto
--8afa774c-A-- [24/Feb/2023:04:34:53 +0100] Y-WoWiTsAtEsT123 12.139.152.111 14327 ...
--8afa774c-B-- POST /its/a/test/dude HTTP/1.1 Host: www.my-site.de Content-Type: text/plain ...

```

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 24, 2023, 5:18pm UTC](https://discuss.elastic.co/t/using-aggregate-to-add-modsecurity-data-to-previous-event/326423/2 "2023-02-24T17:18:20Z")

</div>

You may be able to use a [multiline codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html). Something like

```
input { file { codec => { pattern => "^--" negate => true what => "previous" auto_flush_interval => 5 } ... } }

```

---

<div class="post-metadata">

**Author:** ![admin\_berlin](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@admin\_berlin](https://discuss.elastic.co/u/admin_berlin)\
**Post date:** [February 28, 2023, 7:01pm UTC](https://discuss.elastic.co/t/using-aggregate-to-add-modsecurity-data-to-previous-event/326423/3 "2023-02-28T19:01:40Z")

</div>

My input typ is beats i think i cannot use multiline codec in there.

```auto
  beats{

    port => 5044
    codec => multiline {
      pattern => "^--"
      negate => true
      what => "previous"
      auto_flush_interval => 5 }
  }

```

Error:

```auto
 
[2023-02-28T19:55:17,130][ERROR][logstash.inputs.beats][main] Multiline codec with beats input is not supported. Please refer to the beats documentation for how to best manage multiline data. See https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 28, 2023, 7:33pm UTC](https://discuss.elastic.co/t/using-aggregate-to-add-modsecurity-data-to-previous-event/326423/4 "2023-02-28T19:33:13Z")

</div>

Correct. In that case you would have to do the multiline combination in filebeat instead. You should ask for help in the filebeat forum.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2023, 7:33pm UTC](https://discuss.elastic.co/t/using-aggregate-to-add-modsecurity-data-to-previous-event/326423/5 "2023-03-28T19:33:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.