# How to Parse Interleaved Multi-Service Logs with Filebeat/Logstash - Extracting Complete Transaction Messages

**URL:** <https://discuss.elastic.co/t/how-to-parse-interleaved-multi-service-logs-with-filebeat-logstash-extracting-complete-transaction-messages/374466>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 13, 2025, 1:57am UTC](https://discuss.elastic.co/t/how-to-parse-interleaved-multi-service-logs-with-filebeat-logstash-extracting-complete-transaction-messages/374466 "2025-02-13T01:57:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![saderick](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@saderick](https://discuss.elastic.co/u/saderick)\
**Post date:** [February 13, 2025, 1:57am UTC](https://discuss.elastic.co/t/how-to-parse-interleaved-multi-service-logs-with-filebeat-logstash-extracting-complete-transaction-messages/374466/1 "2025-02-13T01:57:31Z")

</div>

Hi Guys,  
I'm new on FileBeat or Logstash, here is my problem,  
I need to parse log files where multiple applications alternately write entries into the same file using Filebeat or Logstash.

Our scenario:

- Multiple services write to the same log file with entries like:

```auto
[Service1] Txn started: AAA Txn
[Service1] bla bla bla 
[Service2] Txn started: BBB Txn
[Service2] bla bla bla
[Service2] Txn finished: BBB Txn
[Service1] Txn finished: AAA Txn

```

- Each service (Service1/Service2) only has one active transaction at a time
- Goal: Extract complete transaction logs from start to finish as separate messages for each service like  
message 1:

```auto
[Service1] Txn started: AAA Txn\n[Service1] bla bla bla\n[Service1] Txn finished: AAA Txn

```

and 2

```auto
[Service2] Txn started: BBB Txn\n[Service2] bla bla bla\n[Service2] Txn finished: BBB Txn

```