# Each log line is split into a different document in Elastic

**URL:** https://discuss.elastic.co/t/each-log-line-is-split-into-a-different-document-in-elastic/338144
**Category:** Logstash
**Created:** [July 11, 2023, 5:07pm UTC](https://discuss.elastic.co/t/each-log-line-is-split-into-a-different-document-in-elastic/338144 "2023-07-11T17:07:29Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Merav\_Yaacov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/merav_yaacov/32/122958_2.png) [@Merav\_Yaacov](https://discuss.elastic.co/u/Merav_Yaacov)
#### Post date: [July 11, 2023, 5:07pm UTC](https://discuss.elastic.co/t/each-log-line-is-split-into-a-different-document-in-elastic/338144/1 "2023-07-11T17:07:29Z")

</div>

Hi,  
What can be the reason that each line of log file is split into single document in Elastic?  
That's how Logstash is configured:

```auto
input {
  file {
        type => "log"
        path => ["/etc/logstash/conf.d/files/*.log"]
        sincedb_path => "/etc/logstash/conf.d/sincedb.log" }
}

output {
  stdout {
        codec => rubydebug
  }
  elasticsearch {
        hosts => ["https://<hostname>:9200"]
        index => "failure-logs"
        user => "elastic"
        password => " ****"
        ssl => true
        cacert => "/etc/logstash/conf.d/ca.crt"
  }
}

```

In Elastic each line is populated into different document.

Thanks

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 11, 2023, 7:03pm UTC](https://discuss.elastic.co/t/each-log-line-is-split-into-a-different-document-in-elastic/338144/2 "2023-07-11T19:03:01Z")

</div>

> [@Merav\_Yaacov](#):
>
> In Elastic each line is populated into different document.

That is working as expected. A file input consumes files one line at a time. If you need to combine lines you may want to use a multiline codec.

---

<div class="post-metadata">

### Author: ![Merav\_Yaacov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/merav_yaacov/32/122958_2.png) [@Merav\_Yaacov](https://discuss.elastic.co/u/Merav_Yaacov)
#### Post date: [July 12, 2023, 4:25am UTC](https://discuss.elastic.co/t/each-log-line-is-split-into-a-different-document-in-elastic/338144/3 "2023-07-12T04:25:44Z")

</div>

Got it. Thank you! 🙂

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 12, 2023, 5:37am UTC](https://discuss.elastic.co/t/each-log-line-is-split-into-a-different-document-in-elastic/338144/4 "2023-07-12T05:37:53Z")

</div>

A simplified version ML coded of [this](https://discuss.elastic.co/t/multiline-codec-message-mismatch-between-es-and-ruby-plugin-logger/170194):

```auto
input {
  file {
    path => "/path/file.log"
    sincedb_path => "/dev/null"
    start_position => "beginning"
      codec => multiline {
      pattern => "^<pattern>" # how LS will recognize what is the first line
      negate => "true"
      what => "previous"
    }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 9, 2023, 5:38am UTC](https://discuss.elastic.co/t/each-log-line-is-split-into-a-different-document-in-elastic/338144/5 "2023-08-09T05:38:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.