# Combining all log lines starting with the same timestamps to a single event

**URL:** <https://discuss.elastic.co/t/combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/79537>\
**Category:** Logstash\
**Created:** [March 22, 2017, 6:43am UTC](https://discuss.elastic.co/t/combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/79537 "2017-03-22T06:43:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex88](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@alex88](https://discuss.elastic.co/u/alex88)\
**Post date:** [March 22, 2017, 6:43am UTC](https://discuss.elastic.co/t/combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/79537/1 "2017-03-22T06:43:59Z")

</div>

i have apache mod\_wsgi log:

> [Sun Mar 05 14:26:12.858516 2017] [wsgi:error] [pid 11254:tid 140473096181504]  
> [Sun Mar 05 14:26:12.859199 2017] [wsgi:error] [pid 11254:tid 140473096181504] /usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py:852: I  
> nsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: [https://urllib3.readthedocs.i](https://urllib3.readthedocs.i)  
> o/en/latest/advanced-usage.html#ssl-warnings  
> [Sun Mar 05 14:26:12.859210 2017] [wsgi:error] [pid 11254:tid 140473096181504] InsecureRequestWarning)  
> [Sun Mar 05 14:26:12.859215 2017] [wsgi:error] [pid 11254:tid 140473096181504]  
> [Sun Mar 05 14:26:12.859640 2017] [wsgi:error] [pid 11254:tid 140473087788800] /usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py:852: I  
> nsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: [https://urllib3.readthedocs.i](https://urllib3.readthedocs.i)  
> o/en/latest/advanced-usage.html#ssl-warnings  
> [Sun Mar 05 14:26:12.859650 2017] [wsgi:error] [pid 11254:tid 140473087788800] InsecureRequestWarning)

and i want to combine all log lines starting with this part of timestamp [Sun Mar 05 14:26:12] to a single event. How i can achive this using multiline patern?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 22, 2017, 6:46am UTC](https://discuss.elastic.co/t/combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/79537/2 "2017-03-22T06:46:07Z")

</div>

I don't think that's possible with the stock plugins. Also, I don't see why it would be a good idea in the first place.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2017, 6:46am UTC](https://discuss.elastic.co/t/combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/79537/3 "2017-04-19T06:46:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.