# Filebeat combining all log lines starting with the same timestamps to a single event

**URL:** <https://discuss.elastic.co/t/filebeat-combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/77418>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 5, 2017, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/77418 "2017-03-05T14:45:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex88](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@alex88](https://discuss.elastic.co/u/alex88)\
**Post date:** [March 5, 2017, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/77418/1 "2017-03-05T14:45:50Z")

</div>

i have apache wsgi log:

```
[Sun Mar 05 14:26:12.858516 2017] [wsgi:error] [pid 11254:tid 140473096181504]
[Sun Mar 05 14:26:12.859199 2017] [wsgi:error] [pid 11254:tid 140473096181504] /usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py:852: I
nsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.i
o/en/latest/advanced-usage.html#ssl-warnings
[Sun Mar 05 14:26:12.859210 2017] [wsgi:error] [pid 11254:tid 140473096181504] InsecureRequestWarning)
[Sun Mar 05 14:26:12.859215 2017] [wsgi:error] [pid 11254:tid 140473096181504]
[Sun Mar 05 14:26:12.859640 2017] [wsgi:error] [pid 11254:tid 140473087788800] /usr/local/lib/python3.5/dist-packages/urllib3/connectionpool.py:852: I
nsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.i
o/en/latest/advanced-usage.html#ssl-warnings
[Sun Mar 05 14:26:12.859650 2017] [wsgi:error] [pid 11254:tid 140473087788800] InsecureRequestWarning)

```

and i want to combine all log lines starting with this part of timestamp [Sun Mar 05 14:26:12] to a single event. How i can achive this using multiline patern?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 6, 2017, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/77418/2 "2017-03-06T15:05:19Z")

</div>

TBH I can't think of a way how this could be done with the current implementation we have. Perhaps check on the logstash side if they have something that could support this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2017, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/77418/3 "2017-04-03T15:05:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.