# How to break logs into different lines(events)

**URL:** <https://discuss.elastic.co/t/how-to-break-logs-into-different-lines-events/108264>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 19, 2017, 4:25am UTC](https://discuss.elastic.co/t/how-to-break-logs-into-different-lines-events/108264 "2017-11-19T04:25:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishnu\_Garg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishnu_garg/32/24428_2.png) [@Vishnu\_Garg](https://discuss.elastic.co/u/Vishnu_Garg)\
**Post date:** [November 19, 2017, 4:25am UTC](https://discuss.elastic.co/t/how-to-break-logs-into-different-lines-events/108264/1 "2017-11-19T04:25:09Z")

</div>

Hi Everyone,  
Thanks for help in advance.

i have logs like :  
2017-11-18 14:19:29 [tomcat-http--850] INFO  
2017-11-18 14:19:29 [tomcat-http--850] INFO

i want to set in "multiline.pattern:" a regex expression but what ever i try does not seem to right

can anyone suggest me solution?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 19, 2017, 8:19pm UTC](https://discuss.elastic.co/t/how-to-break-logs-into-different-lines-events/108264/2 "2017-11-19T20:19:21Z")

</div>

What are you trying to do?  
If you are setting multiline then you must want to merge the lines. But your subject suggests you don't want to merge them and you want line-by-line?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2017, 8:19pm UTC](https://discuss.elastic.co/t/how-to-break-logs-into-different-lines-events/108264/3 "2017-12-17T20:19:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
