# \[Filebeat\]\[K8S\] How to process multiple types of logs (1 single + 2 different multiple lines) in one file?

**URL:** https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160
**Category:** Beats
**Tags:** filebeat
**Created:** [April 25, 2022, 12:44pm UTC](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160 "2022-04-25T12:44:25Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![vasek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vasek/32/136636_2.png) [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [April 25, 2022, 12:44pm UTC](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160/1 "2022-04-25T12:44:25Z")

</div>

Hello guys,  
can anyone give me tip how to process multiple types of logs in one file for this usecase:  
In the log file I have 3 types of log:

**1) PHP-FPM Access log (is single-line)**

```auto
10.102.0.141 - 25/Apr/2022:11:17:57 +0000 "GET /index.php" 200

```

%R - %u %t "%m %r" %s  
[https://www.php.net/manual/en/install.fpm.configuration.php](https://www.php.net/manual/en/install.fpm.configuration.php)

**2) PHP-FPM Server log (which can be multline)**

```auto
      [25-Apr-2022 09:35:00] [pool www] pid 512 \n script_filename = /app/pub/index.php
      [0x00007f12f5217000] execute() /app/vendor/magento/framework/DB/Statement/Pdo/Mysql.php:91
      [0x00007f12f5216f90] Magento\Framework\DB\Statement\Pdo\{closure}() /app/vendor/magento/framework/DB/Statement/Pdo/Mysql.php:107
      [0x00007f12f5216eb0] tryExecute() /app/vendor/magento/framework/DB/Statement/Pdo/Mysql.php:92
      [0x00007f12f5216e10] _execute() /app/vendor/magento/zendframework1/library/Zend/Db/Statement.php:303
      ...
      [25-Apr-2022 09:35:00] [pool www] ...

```

**3) Application log (which can be multline)**

```auto
2022-04-25T11:17:58+429 (522) D1: Source class "\Phalcon\Http\Message\Request" for "Phalcon\Http\Message\RequestFactory" generation does not exist....

```

The log file is read from file of kubernetes nodes by Filebeat agent. Is it possible to do that without sidecar container?

---

<div class="post-metadata">

### Author: ![vasek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vasek/32/136636_2.png) [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [April 25, 2022, 2:39pm UTC](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160/2 "2022-04-25T14:39:00Z")

</div>

I'm thinking of logging in a container to multiple files and using sidecar container (Filebeat) to collect it.

> **[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)**
>
> Application logs can help you understand what is happening inside your application. The logs are particularly useful for debugging problems and monitoring cluster activity. Most modern applications have some kind of logging mechanism. Likewise,...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04593fd1b67c42d42ff281745208104449bdc086.png)

---

<div class="post-metadata">

### Author: ![vasek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vasek/32/136636_2.png) [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [April 29, 2022, 10:51am UTC](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160/3 "2022-04-29T10:51:24Z")

</div>

We solved this situation by sidecars.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2022, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160/4 "2022-05-27T12:52:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
