# Creating a single output from log file

**URL:** <https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900>\
**Category:** Logstash\
**Created:** [October 25, 2018, 3:52am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900 "2018-10-25T03:52:49Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivabharat](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@shivabharat](https://discuss.elastic.co/u/shivabharat)\
**Post date:** [October 25, 2018, 3:52am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900/1 "2018-10-25T03:52:50Z")

</div>

Hi All,

I would like to know if its possible to read the entire log file and then parse messages and produce a single JASON document / CSV file (single entry)?

Appreciate any pointers on this.

Thanks

---

<div class="post-metadata">

**Author:** ![romainrom](https://avatars.discourse-cdn.com/v4/letter/r/bbce88/32.png) [@romainrom](https://discuss.elastic.co/u/romainrom)\
**Post date:** [October 25, 2018, 7:17am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900/2 "2018-10-25T07:17:39Z")

</div>

Hi,  
I'm quite a newbie in ES... but have you tried the CSV output with path option ?  
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-csv.html#plugins-outputs-csv-dir\_mode](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-csv.html#plugins-outputs-csv-dir_mode)

---

<div class="post-metadata">

**Author:** ![shivabharat](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@shivabharat](https://discuss.elastic.co/u/shivabharat)\
**Post date:** [October 25, 2018, 7:32am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900/3 "2018-10-25T07:32:23Z")

</div>

Yes, when log files is read each message is parsed and there is a entry made in CSV. What I am trying to achieve is read all message and then write the message a single csv entry

E.g. (What works)

One,two,three,  
,four,five,six

What I am trying to do

One,two,three,four,five,six

---

<div class="post-metadata">

**Author:** ![shivabharat](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@shivabharat](https://discuss.elastic.co/u/shivabharat)\
**Post date:** [October 25, 2018, 8:47am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900/4 "2018-10-25T08:47:58Z")

</div>

I was able to achieve the below but I am looking to have all the fields to be part of one single JSON

Current **strong text**  
{"build\_plat":"i686-linux-rhe5,64bit"}  
{"app\_name":"ABC"}  
{"app\_type":"ServerXYZ"}  
{"host\_name":"lab02"}  
{"version\_no":"8.9.400.50"}

Envisaged **strong text**

{  
"build\_plat": "i686-linux-rhe5,64bit",  
"app\_name": "ABC",  
"app\_type": "ServerXYZ",  
"host\_name": "lab02",  
"version\_no": "8.9.400.50"  
}

---

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [October 25, 2018, 11:41am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900/5 "2018-10-25T11:41:49Z")

</div>

hi shiva,  
if you could provide input code, it will be easy for others to provide solution

---

<div class="post-metadata">

**Author:** ![shivabharat](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@shivabharat](https://discuss.elastic.co/u/shivabharat)\
**Post date:** [October 29, 2018, 3:37am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900/6 "2018-10-29T03:37:47Z")

</div>

Below is log snippet

===================================================  
XYZ Or, Version:'8.1.400.50'  
Copyright (c) 2008-2016 XYZ Telecommunications Laboratories, Inc.  
Component versions:  
Commonlib: 8.1.300.37 C2  
Loglib: 8.1.300.11 MT  
Gmessagelib: 8.1.300.01  
GServicelib: 8.1.300.06 MT  
Confservlib: 8.1.300.09  
Lcalib: 8.1.300.07  
T-library 8.1.200.11 HA  
SCXMLlib 8.1.301.01  
Build platform: i686-linux-rhe5,64bit  
Application name: OR\_P  
Application type: OServer (161)  
Command line: ./or -app OR\_P -host lab02 -port 2020  
Host name: lab02  
DST: TZ = 1, timeb = 0  
Time zone: -19800, IST, IST  
UTC time: 2018-10-10T05:51:15.343  
Local time: 2018-10-10T11:21:15.343  
Start time (UTC): 2018-10-10T05:51:15  
Running time: 0:00:00:00  
Host info: Linux, lab02, 2.6.18-194.el5, #1 SMP Tue Mar 16 21:52:39 EDT 2010, x86\_64

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2018, 3:37am UTC](https://discuss.elastic.co/t/creating-a-single-output-from-log-file/153900/7 "2018-11-26T03:37:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
