# Log Parser for multiple fields and files

**URL:** https://discuss.elastic.co/t/log-parser-for-multiple-fields-and-files/209218
**Category:** Logstash
**Created:** [November 25, 2019, 4:58am UTC](https://discuss.elastic.co/t/log-parser-for-multiple-fields-and-files/209218 "2019-11-25T04:58:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![gangireddy\_l](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)
#### Post date: [November 25, 2019, 4:58am UTC](https://discuss.elastic.co/t/log-parser-for-multiple-fields-and-files/209218/1 "2019-11-25T04:58:58Z")

</div>

I need to fetch data which occurs in multiple files and multiple times in the same file.which is presented in the below format.  
19-10-25 Name Succ Fail Reject Thrput Response time (ms)  
(/s) Avg Min Max  
03:08:58 Total request 0 0 0 0 - - -  
Inactive session 0 0 0 0 - - -  
Reevaluated session 0 0 0 0 - - -  
03:09:08 Total request 0 0 0 0 - - -  
Inactive session 0 0 0 0 - - -  
Reevaluated session 0 0 0 0 - - -

---

<div class="post-metadata">

### Author: ![tritri](https://avatars.discourse-cdn.com/v4/letter/t/c68b51/32.png) [@tritri](https://discuss.elastic.co/u/tritri)
#### Post date: [December 10, 2019, 10:38am UTC](https://discuss.elastic.co/t/log-parser-for-multiple-fields-and-files/209218/2 "2019-12-10T10:38:56Z")

</div>

If you want different parsing per file but you're using a single filebeat instance, you could add a field to the message in filebeat.yml (the filebeat config), per input:

```
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log

  # Here, you can define a custom field
  fields:
     apache: true

```

Then, in your logstash pipeline, you could add a conditional like so:

```
input {
	beats {
		port => <your port>
	}
}

filter {
	if [fields][apache] {
		grok {
		   match => { "message" => <your pattern> }
	} else {
                   match => { "message" => <your other pattern> }
}
output {
	stdout { codec => rubydebug }
       }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 7, 2020, 10:39am UTC](https://discuss.elastic.co/t/log-parser-for-multiple-fields-and-files/209218/3 "2020-01-07T10:39:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.