# How to filter log file by id in kibana

**URL:** https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148
**Category:** Logstash
**Created:** [September 10, 2020, 10:46am UTC](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148 "2020-09-10T10:46:06Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![HR\_Amani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hr_amani/32/75278_2.png) [@HR\_Amani](https://discuss.elastic.co/u/HR_Amani)
#### Post date: [September 10, 2020, 10:46am UTC](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148/1 "2020-09-10T10:46:07Z")

</div>

Hi i am new to ELk stack .  
i have a log file that contain many bills. every bill has more then 200 lignes of information plus the id of the bill presented in this way

informations about bill 1 : informations  
bill ID : 1  
\*\*\*\* END SUCESS date format \*\*\*\*\*  
informations about bill 2 : informations  
bill ID : 2  
\*\*\*\* END SUCESS date format \*\*\*\*\*

i need to filter every bill by it iD in kibana , does any one have any idea how to do this ?

my idea was to split the logs with grok at the begining of every \*\*\*\* END SUCESS  
but how can i put every bill in single message .

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 10, 2020, 2:58pm UTC](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148/2 "2020-09-10T14:58:44Z")

</div>

Use a multiline codec on the input to combine all the lines for a single bill.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 8, 2020, 2:58pm UTC](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148/3 "2020-10-08T14:58:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
