# ElasticSearch - Logstash multiple messages

**URL:** <https://discuss.elastic.co/t/elasticsearch-logstash-multiple-messages/36002>\
**Category:** Logstash\
**Created:** [December 1, 2015, 8:15am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-multiple-messages/36002 "2015-12-01T08:15:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![deseint](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@deseint](https://discuss.elastic.co/u/deseint)\
**Post date:** [December 1, 2015, 8:15am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-multiple-messages/36002/1 "2015-12-01T08:15:17Z")

</div>

Hello,  
I'm new with logstash. I insert several files (doc and pdf format) into ES via logstash and it did well, but i'm desappointed by the field which name is message (fullfilled with the content of my file).  
In fact, each file is divided in 2 or 3 messages in ElasticSearch. And when i'm doing a count in ES, of course it doesn't give me the right information...  
See my configuration file for logstash:  
input { file {  
path =\> "D:/BaseCV/\*"  
codec =\> multiline {  
pattern =\> ""  
what =\> "next"  
} }}  
filter {  
mutate { add\_field =\> { "[metadata][nom]" =\> "nom" } }  
mutate { add\_field =\> { "[metadata][prenom]" =\> "prenom" } }  
mutate { add\_field =\> { "[metadata][date]" =\> "dd/MMM/YYYY HH:mm:ss" } }  
}  
output {  
stdout { codec =\> rubydebug { metadata =\> true } }  
elasticsearch {  
hosts =\> "localhost"  
index =\> "cvindex"  
document\_type =\> "file"  
}}  
Please, how can I ameliorate this file.conf in order to have always 1 message per file ?

---

<div class="post-metadata">

**Author:** ![amitkumar](https://avatars.discourse-cdn.com/v4/letter/a/41988e/32.png) [@amitkumar](https://discuss.elastic.co/u/amitkumar)\
**Post date:** [May 19, 2017, 7:26am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-multiple-messages/36002/2 "2017-05-19T07:26:42Z")

</div>

I am also facing same issue.please let me know if you have resolved this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-multiple-messages/36002/3 "2017-07-06T04:26:28Z")

</div>