# How to separate a log line by line
**URL:** https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232
**Category:** Beats
**Tags:** filebeat
**Created:** [January 30, 2020, 3:37pm UTC](https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232 "2020-01-30T15:37:36Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Ben240489](https://discuss.elastic.co/u/Ben240489)
#### Post date: [January 30, 2020, 3:37pm UTC](https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232/1 "2020-01-30T15:37:36Z")
Hi,
I'm pretty new here and I am experimenting with ELK. One thing I couldn't figure out until now is: How can I parse a log line by line with each line becoming its own event?
For example, I have a log file which looks like this:
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !
Each line has the same build up but I don't want it to be processed as "multiline". How can I process the logfile in a way that each line becomes it's own message?
---
### Author:  [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)
#### Post date: [January 30, 2020, 3:42pm UTC](https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232/2 "2020-01-30T15:42:29Z")
Hi, thanks for reaching out! Which module in Filebeat are you using? Or are you using the log file as input?
---
### Author:  [@Ben240489](https://discuss.elastic.co/u/Ben240489)
#### Post date: [February 5, 2020, 12:22pm UTC](https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232/3 "2020-02-05T12:22:14Z")
Hi Kaiyan\_Sheng,
Already solved it. It was a misconfiguration within the Filebeat still having a multi-line parameter active 🙂
After deleting, it worked fine!
---
### Author:  [@Bubunia\_Patra](https://discuss.elastic.co/u/Bubunia_Patra)
#### Post date: [February 6, 2020, 4:21am UTC](https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232/4 "2020-02-06T04:21:39Z")
Hi Ben,
Would you mind providing the filebeat.yml file? We are also facing the similar issue. After excluding the multi-line parameter the lines were not coming in the log. But the problem is if we add the multiline parameter in filebeat.yml we should be getting the logs but it should be coming in single line rather than multiple line. Need your help. Any help would be appreciated.
> [@Filebeat parsing issue](https://discuss.elastic.co/t/filebeat-parsing-issue/217914):
>
> Hi, I am trying to fix a issue in the filebeat configuration file where it adds newline to the parsed logs and forwards to graylog/ES. I want the log to be in single line rather than multiple line. Even if the file(access.log) contains multi-line as the input I want to make the file to be single line removing any carriage return and merge to a single line. I am not sure how the multi-line lines are matching in this case as the regex is checking the | and there is no input with date format? Can …
Regards
Pradeep
---
### Author:  [@Bubunia\_Patra](https://discuss.elastic.co/u/Bubunia_Patra)
#### Post date: [February 6, 2020, 3:34pm UTC](https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232/5 "2020-02-06T15:34:28Z")
Hi,
Thanks for quick response. We are using logfile as input which is collected from different sources and filebeat formats the nginx log before forwarding to graylog. The problem is for some misconfigurations of filebeat which result in multiline. Need your help in fixing this issue.
Regards
Pradeep
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 5, 2020, 3:34pm UTC](https://discuss.elastic.co/t/how-to-separate-a-log-line-by-line/217232/6 "2020-03-05T15:34:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.