How to separate a log line by line

[Ben240489]

Hi,

I'm pretty new here and I am experimenting with ELK. One thing I couldn't figure out until now is: How can I parse a log line by line with each line becoming its own event?
For example, I have a log file which looks like this:
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !

Each line has the same build up but I don't want it to be processed as "multiline". How can I process the logfile in a way that each line becomes it's own message?

[Kaiyan_Sheng]

Hi, thanks for reaching out! Which module in Filebeat are you using? Or are you using the log file as input?

[Ben240489]

Hi Kaiyan_Sheng,
Already solved it. It was a misconfiguration within the Filebeat still having a multi-line parameter active
After deleting, it worked fine!

[Bubunia_Patra]

Hi Ben,

Would you mind providing the filebeat.yml file? We are also facing the similar issue. After excluding the multi-line parameter the lines were not coming in the log. But the problem is if we add the multiline parameter in filebeat.yml we should be getting the logs but it should be coming in single line rather than multiple line. Need your help. Any help would be appreciated.

Filebeat parsing issue

Hi, I am trying to fix a issue in the filebeat configuration file where it adds newline to the parsed logs and forwards to graylog/ES. I want the log to be in single line rather than multiple line. Even if the file(access.log) contains multi-line as the input I want to make the file to be single line removing any carriage return and merge to a single line. I am not sure how the multi-line lines are matching in this case as the regex is checking the | and there is no input with date format? Can …

Regards
Pradeep

[Bubunia_Patra]

Hi,

Thanks for quick response. We are using logfile as input which is collected from different sources and filebeat formats the nginx log before forwarding to graylog. The problem is for some misconfigurations of filebeat which result in multiline. Need your help in fixing this issue.

Regards
Pradeep