# Create full single log file in one message event through filebeat?

**URL:** https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049
**Category:** Beats
**Tags:** filebeat
**Created:** [March 8, 2018, 11:03am UTC](https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049 "2018-03-08T11:03:38Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![zakkhan](https://avatars.discourse-cdn.com/v4/letter/z/b5a626/32.png) [@zakkhan](https://discuss.elastic.co/u/zakkhan)
#### Post date: [March 8, 2018, 11:03am UTC](https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049/1 "2018-03-08T11:03:39Z")

</div>

By default, Filebeat parse log files line by line and create message events after every new line. Is there any way i can have whole log file in one message event instead of chunks in elastic search.

---

<div class="post-metadata">

### Author: ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)
#### Post date: [March 8, 2018, 12:11pm UTC](https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049/2 "2018-03-08T12:11:40Z")

</div>

the use case is not something i would recommend but you can use the multiline option on the prospector with a very high setting for multiline.max\_lines

[https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)

you would have to search a regex that is never the beginning of a line... that will be the hard part

Edit:  
you could try something like  
multiline.pattern: '^.'  
multiline.negate: false  
multiline.match: after  
multiline.max\_lines: 1000000

---

<div class="post-metadata">

### Author: ![zakkhan](https://avatars.discourse-cdn.com/v4/letter/z/b5a626/32.png) [@zakkhan](https://discuss.elastic.co/u/zakkhan)
#### Post date: [March 8, 2018, 12:44pm UTC](https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049/3 "2018-03-08T12:44:52Z")

</div>

Thanks, this one works for me.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 5, 2018, 12:44pm UTC](https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049/4 "2018-04-05T12:44:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.