# How to merge log events as a single log event, when frequent updates happens to a file

**URL:** <https://discuss.elastic.co/t/how-to-merge-log-events-as-a-single-log-event-when-frequent-updates-happens-to-a-file/200054>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 18, 2019, 4:30pm UTC](https://discuss.elastic.co/t/how-to-merge-log-events-as-a-single-log-event-when-frequent-updates-happens-to-a-file/200054 "2019-09-18T16:30:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mahesh\_Guntumadugu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_guntumadugu/32/54413_2.png) [@Mahesh\_Guntumadugu](https://discuss.elastic.co/u/Mahesh_Guntumadugu)\
**Post date:** [September 18, 2019, 4:30pm UTC](https://discuss.elastic.co/t/how-to-merge-log-events-as-a-single-log-event-when-frequent-updates-happens-to-a-file/200054/1 "2019-09-18T16:30:53Z")

</div>

Data will be written in log file while installing product at random time interval.Overall it will take 10 minutes time to finish the whole installation process.

with multiline settings , I was able to send whole file as a single event when no updates happens to file(log data fixed and no updates while harvesting).

Do we have any control to merge the whole log file data as a single event when frequent updates happen to log file ? Tried queue.mem( ([https://www.elastic.co/guide/en/beats/filebeat/current/configuring-internal-queue.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-internal-queue.html))) and it is not working.

Can someone share the insights/options towards the expected outcome?

**Log file data:**  
STEP 1: Validate Configuration Data File path

STEP 2: Read Configuration Data File

................ some more steps

STEP 100: registered services successfully, services are in running state

Product Installation Successfully Completed

**FileBeat.Yml Config:**

- type: log  
enabled: true  
paths:

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2019, 4:30pm UTC](https://discuss.elastic.co/t/how-to-merge-log-events-as-a-single-log-event-when-frequent-updates-happens-to-a-file/200054/2 "2019-10-16T16:30:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.