---
title: "Referencing earlier messages of the context"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-parsers/chapter-patterndb/configuring-pattern-databases/patterndb-correlation/referencing-previous-messages/"
last_modified: "2023-07-15T16:57:02+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Referencing earlier messages of the context

When using the `<value>` element in pattern database rules together with message correlation, you can also refer to fields and values of earlier messages of the context by adding the `@<distance-of-referenced-message-from-the-current>` suffix to the macro. For example, if there are three log messages in a context, and you are creating a generated message for the third log message, the `${HOST}@1` expression refers to the host field of the current (third) message in the context, the `${HOST}@2` expression refers to the host field of the previous (second) message in the context, `${PID}@3` to the PID of the first message, and so on. For example, the following message can be created from SSH login/logout messages (for details on generating new messages, see [Triggering actions for identified messages](https://axoflow.com/docs/axosyslog-core/4.28/chapter-parsers/chapter-patterndb/patterndb-triggers-actions/index.md)): `An SSH session for ${SSH_USERNAME}@1 from ${SSH_CLIENT_ADDRESS}@2 closed. Session lasted from ${DATE}@2 to ${DATE}`.

> **Warning:**
> When referencing an earlier message of the context, always enclose the field name between braces, for example, `${PID}@3`. The reference will not work if you omit the braces.

> **Note:**
> To use a literal `@` character in a template, use `@@`.

## Example: Referencing values from an earlier message

The following action can be used to log the length of an SSH session (the time difference between a login and a logout message in the context):

```shell
   <actions>
        <action>
            <message>
                <values>
                    <value name="MESSAGE">An SSH session for ${SSH_USERNAME}@1 from ${SSH_CLIENT_ADDRESS}@2 closed. Session lasted from ${DATE}@2 to ${DATE} </value>
                </values>
            </message>
        </action>
    </actions>
```

If you do not know in which message of the context contains the information you need, you can use the [grep](https://axoflow.com/docs/axosyslog-core/4.28/chapter-manipulating-messages/customizing-message-format/reference-template-functions/index.md), the [context-lookup](https://axoflow.com/docs/axosyslog-core/4.28/chapter-manipulating-messages/customizing-message-format/reference-template-functions/index.md), or the [context-values](https://axoflow.com/docs/axosyslog-core/4.28/chapter-manipulating-messages/customizing-message-format/reference-template-functions/index.md) template functions.

### Example: Using the grep template function

The following example selects the message of the context that has a `username` name-value pair with the `root` value, and returns the value of the `auth_method` name-value pair.

```shell
   $(grep ("${username}" == "root") ${auth_method})
```

To perform calculations on fields that have numerical values, see [Numerical operations](https://axoflow.com/docs/axosyslog-core/4.28/chapter-manipulating-messages/customizing-message-format/reference-template-functions/index.md).

Last modified July 15, 2023: [Patterndb chapter formatting fixes (f7dfdaa0)](https://github.com/axoflow/axosyslog-core-docs/commit/f7dfdaa0fa045e2ae66345dc5a1c70a179726476)