# Ingest multiline auditd events from syslog sources

**URL:** <https://discuss.elastic.co/t/ingest-multiline-auditd-events-from-syslog-sources/370904>\
**Category:** Logstash\
**Created:** [November 21, 2024, 4:36pm UTC](https://discuss.elastic.co/t/ingest-multiline-auditd-events-from-syslog-sources/370904 "2024-11-21T16:36:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![gamb](https://avatars.discourse-cdn.com/v4/letter/g/edb3f5/32.png) [@gamb](https://discuss.elastic.co/u/gamb)\
**Post date:** [November 21, 2024, 4:36pm UTC](https://discuss.elastic.co/t/ingest-multiline-auditd-events-from-syslog-sources/370904/1 "2024-11-21T16:36:32Z")

</div>

Hello,

I would like to merge (or aggregate) auditd logs with logstash. I have see lot of solutions with an agent but it seem tricky to do with a syslog source ☹

I received auditd messages form multiple sources on a unique logstash pipeline. Each source is a syslog server that centralize auditd messages from multiple hosts.  
hosts -\> syslog servers -\> my logstash.

The multiline option seems not working if i have multiple hosts sending logs at the same time. We cant be sure all messages arrived with right order.

I think i can do this in two step : Firstly logstash receive messages and store them in a file or an index. And in a second time (another pipeline), logstash read this temporary documents and use aggregate filter to merge multi line auditd messages into one new event.

I would like to know if there are others methods, simplier and better, to ingest multiline events with multiple sources on a single logstash pipeline ?

Thank you, Gamb.