### Author:  [@mfellah](https://discuss.elastic.co/u/mfellah)
#### Post date: [November 3, 2017, 4:35pm UTC](https://discuss.elastic.co/t/extract-rows-from-log-using-http-plugin/106344/1 "2017-11-03T16:35:11Z")
Hi,
I'm trying to use http plugin to receive log with this format :
2017-10-31-07:29:05 - DEBUG Waiting for callback, for command id : 56232
2017-10-31-07:29:05 - DEBUG Waiting for callback...
2017-10-31-07:29:06 - DEBUG Callback called after 1000
I have this configuration file :
```
input {
http {
}
}
filter
{
split{
}
grok {
match => { "message" => "(?\d{4}-\d{2}-\d{2}-\d{2}:\d{2}:\d{2}) - %{WORD:loglevel} %{GREEDYDATA:description}"}
}
}
output {
stdout {
codec => rubydebug
}
}
```
Unfortunately, logstash reads all the log input in one event. (as if it was an one line log file).
How should I configure logstash?
thank you very much by advance
Mohamed
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 6, 2017, 6:20am UTC](https://discuss.elastic.co/t/extract-rows-from-log-using-http-plugin/106344/2 "2017-11-06T06:20:26Z")
Works fine for me. Please show an example from your stdout output.
---
### Author:  [@mfellah](https://discuss.elastic.co/u/mfellah)
#### Post date: [November 6, 2017, 9:25am UTC](https://discuss.elastic.co/t/extract-rows-from-log-using-http-plugin/106344/3 "2017-11-06T09:25:51Z")
Thank you for answering
I have this result :
```
{
"date" => "2017-10-31-07:29:05",
"headers" => {
"http_accept" => "*/*",
"content_type" => "application/x-www-form-urlencoded",
"request_path" => "/twitter/tweet/1",
"http_version" => "HTTP/1.1",
"request_method" => "PUT",
"http_host" => "localhost:8080",
"request_uri" => "/twitter/tweet/1",
"content_length" => "177",
"http_user_agent" => "curl/7.38.0"
},
"@timestamp" => 2017-11-06T09:20:42.873Z,
"loglevel" => "DEBUG",
"@version" => "1",
"host" => "127.0.0.1",
"description" => "Waiting for callback, for command id : 562322017-10-31-07:29:05 - DEBUG Waiting for callback...2017-10-31-07:29:06 - DEBUG Callback called after 1000",
"message" => "2017-10-31-07:29:05 - DEBUG Waiting for callback, for command id : 562322017-10-31-07:29:05 - DEBUG Waiting for callback...2017-10-31-07:29:06 - DEBUG Callback called after 1000"
}
```
I would like something like :
```
{
"date" => "2017-10-31-07:29:05",
"headers" => {
"http_accept" => "*/*",
"content_type" => "application/x-www-form-urlencoded",
"request_path" => "/twitter/tweet/1",
"http_version" => "HTTP/1.1",
"request_method" => "PUT",
"http_host" => "localhost:8080",
"request_uri" => "/twitter/tweet/1",
"content_length" => "177",
"http_user_agent" => "curl/7.38.0"
},
"@timestamp" => 2017-11-06T09:20:42.873Z,
"loglevel" => "DEBUG",
"@version" => "1",
"host" => "127.0.0.1",
"description" => "Waiting for callback, for command id : 562322",
"message" => "2017-10-31-07:29:05 - DEBUG Waiting for callback, for command id : 56232"
},
{
"date" => "2017-10-31-07:29:05",
"headers" => {
"http_accept" => "*/*",
"content_type" => "application/x-www-form-urlencoded",
"request_path" => "/twitter/tweet/1",
"http_version" => "HTTP/1.1",
"request_method" => "PUT",
"http_host" => "localhost:8080",
"request_uri" => "/twitter/tweet/1",
"content_length" => "177",
"http_user_agent" => "curl/7.38.0"
},
"@timestamp" => 2017-11-06T09:20:42.873Z,
"loglevel" => "DEBUG",
"@version" => "1",
"host" => "127.0.0.1",
"description" => "Waiting for callback, for command id : 562322",
"message" => "2017-10-31-07:29:05 - DEBUG Waiting for callback..."
},
{
"date" => "2017-10-31-07:29:06",
"headers" => {
"http_accept" => "*/*",
"content_type" => "application/x-www-form-urlencoded",
"request_path" => "/twitter/tweet/1",
"http_version" => "HTTP/1.1",
"request_method" => "PUT",
"http_host" => "localhost:8080",
"request_uri" => "/twitter/tweet/1",
"content_length" => "177",
"http_user_agent" => "curl/7.38.0"
},
"@timestamp" => 2017-11-06T09:20:42.873Z,
"loglevel" => "DEBUG",
"@version" => "1",
"host" => "127.0.0.1",
"description" => "Callback called after 1000",
"message" => "2017-10-31-07:29:06 - DEBUG Callback called after 1000"
}
```
thank you
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 6, 2017, 10:34am UTC](https://discuss.elastic.co/t/extract-rows-from-log-using-http-plugin/106344/4 "2017-11-06T10:34:01Z")
Okay, weird. I get the expected result with Logstash 2.4.
---
### Author:  [@mfellah](https://discuss.elastic.co/u/mfellah)
#### Post date: [November 6, 2017, 10:55am UTC](https://discuss.elastic.co/t/extract-rows-from-log-using-http-plugin/106344/5 "2017-11-06T10:55:46Z")
I have the 5.6.0 version (result of logstash --version)
I'm using the last version of ELK
---
### Author:  [@mfellah](https://discuss.elastic.co/u/mfellah)
#### Post date: [November 22, 2017, 4:39pm UTC](https://discuss.elastic.co/t/extract-rows-from-log-using-http-plugin/106344/6 "2017-11-22T16:39:12Z")
Any other idea maybe?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2017, 4:39pm UTC](https://discuss.elastic.co/t/extract-rows-from-log-using-http-plugin/106344/7 "2017-12-20T16:39:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.