# Filebeat multiline java app log4j logs

**URL:** <https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 27, 2017, 6:34pm UTC](https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018 "2017-09-27T18:34:20Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 8, 2017, 11:26am UTC](https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018/5 "2017-10-08T11:26:46Z")

</div>

You are looking for some kind of correlation/join operation. In order to pull this of you will need:

- transaction 'ID'
- parse/grok message
- stable (hash-based) partitioning (as you have multiple instances)
- (time windowed) join/correlation

Re-consider if you really need to pre-corrlate the data in order to build your dashboards. Correlation can be 'expensive' and potentially bloats processing architecture. Also see: [Merging rails log lines](https://discuss.elastic.co/t/merging-rails-log-lines/102624/2)

Btw. filebeat supports parsing json. Using log4j with [json layout](https://logging.apache.org/log4j/2.x/manual/layouts.html) and attaching an ID (e.g. via [ThreadContext](https://logging.apache.org/log4j/2.x/manual/thread-context.html) or custom field) one can configure the kafka output in filebeat to hash/partition based on the ID. In this case each Logstash instance will receive all events for a given ID -\> you can correlate via aggregate filter. Well, haven't used log4j for years, so no idea how easy it is to build something like this.

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018)._