# Is it possible to combine the entire file as one event? **URL:** \ **Category:** Logstash\ **Created:** [June 15, 2015, 9:55pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-the-entire-file-as-one-event/2743 "2015-06-15T21:55:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![nathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@nathaniel](https://discuss.elastic.co/u/nathaniel)\ **Post date:** [June 15, 2015, 9:55pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-the-entire-file-as-one-event/2743/1 "2015-06-15T21:55:49Z")
Hi guys. I am facing a situation where every of my log files are single exceptions, and I do not wish to store them line by line. Instead, I would prefer to store them file by file, which means, I wish to combine the entire log file as one event. I've check the multiline codec, but it doesn't seem to work, I wonder if there are any ways to do it. Thanks in advance. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 15, 2015, 10:48pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-the-entire-file-as-one-event/2743/2 "2015-06-15T22:48:19Z")
Multiline is going to be the best best. What is your problem with it, what does your config look like? ---
**Author:** ![thehybridtech](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@thehybridtech](https://discuss.elastic.co/u/thehybridtech)\ **Post date:** [June 16, 2015, 6:23pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-the-entire-file-as-one-event/2743/3 "2015-06-16T18:23:20Z")
I think I have a similar case. I process previously created log bundles and correlate data points. Many times, one file functions as a single data point and thus one event. I may run splits on the data once I have it in the pipeline but I need the entire file in the pipeline to provide correlation points. Because there is no standard character to represent the end of a file using pattern match in multiline and file acts like tail -0f causing multiline to continue to wait for the end, I cannot treat one file as a single event without massaging the data before entering the logstash pipeline. What I will do is add **_ENDOFFILE_** and then pattern match against it to indicate end of stream for multiline. I too, would appreciate any information about whole file intake. Thanks ---
**Author:** ![Kit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kit/32/5185_2.png) [@Kit](https://discuss.elastic.co/u/Kit)\ **Post date:** [October 8, 2015, 5:20pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-the-entire-file-as-one-event/2743/4 "2015-10-08T17:20:44Z")
> [@thehybridtech](#): > > end of a file using pattern match in multiline and file acts like tail -0f causing multiline to continue to wait for the end, I cannot treat one file as a single event without massaging the data before entering the logstash pipeline. +1 We need to be able to treat things like upgrade logs. Each upgrade event produces a log file. We need to be able to go over each of these upgrade events and read the raw log output in the message to troubleshoot some deployments. If anyone has a solution for ingesting files as events and maintaining original formatting in the message, please let me know. Thanks! ---
**Author:** ![domich](https://avatars.discourse-cdn.com/v4/letter/d/f14d63/32.png) [@domich](https://discuss.elastic.co/u/domich)\ **Post date:** [May 30, 2016, 4:32am UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-the-entire-file-as-one-event/2743/5 "2016-05-30T04:32:11Z")
Hi, Is there any progress about this issue? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-the-entire-file-as-one-event/2743/6 "2017-07-06T04:55:36Z")