# Filebeat send the entire logfile as a single message

**URL:** https://discuss.elastic.co/t/filebeat-send-the-entire-logfile-as-a-single-message/118265
**Category:** Beats
**Tags:** filebeat
**Created:** [February 2, 2018, 6:14pm UTC](https://discuss.elastic.co/t/filebeat-send-the-entire-logfile-as-a-single-message/118265 "2018-02-02T18:14:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![saikrishnagaddipati](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@saikrishnagaddipati](https://discuss.elastic.co/u/saikrishnagaddipati)
#### Post date: [February 2, 2018, 6:14pm UTC](https://discuss.elastic.co/t/filebeat-send-the-entire-logfile-as-a-single-message/118265/1 "2018-02-02T18:14:58Z")

</div>

I am using filebeat-5.6  
My config filebeat -\> logstash -\> elasticsearch -\> kibana

I have hundreds of log files with 1KB - 2KB data( usually each file has atmost 15 lines of messages in them) in a folder. Is it possible to configure filebeat to send entire messages in each log file as a single message to elasticsearch and then view the whole log file messages in kibana's document message field.

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [February 9, 2018, 1:03pm UTC](https://discuss.elastic.co/t/filebeat-send-the-entire-logfile-as-a-single-message/118265/2 "2018-02-09T13:03:33Z")

</div>

Filebeat reads fundamentally line by line, but I think it should be possible to use a [multiline](https://www.elastic.co/guide/en/beats/filebeat/6.2/multiline-examples.html) configuration to match up together everything from the file.

For example, the following should put together any lines:

```auto
  multiline.pattern: '.'
  multiline.match: after

```

Multiline doesn't match across files, so the EOF then works as a natural demarcation line. A quick test shows that this should work.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2018, 1:03pm UTC](https://discuss.elastic.co/t/filebeat-send-the-entire-logfile-as-a-single-message/118265/3 "2018-03-09T13:03:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.