# Logs are being aggregated not separate lines

**URL:** <https://discuss.elastic.co/t/logs-are-being-aggregated-not-separate-lines/224652>\
**Category:** Elasticsearch\
**Created:** [March 23, 2020, 10:50am UTC](https://discuss.elastic.co/t/logs-are-being-aggregated-not-separate-lines/224652 "2020-03-23T10:50:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![calanon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/calanon/32/64004_2.png) [@calanon](https://discuss.elastic.co/u/calanon)\
**Post date:** [March 23, 2020, 10:50am UTC](https://discuss.elastic.co/t/logs-are-being-aggregated-not-separate-lines/224652/1 "2020-03-23T10:50:25Z")

</div>

I am not sure if this is a logstash or elasticsearch subject.

I am pulling nginx\_error logs from filebeats \> logstash \> elasticsearch

The thing I have noticed that it is grouping all the messages together like the following output and not displaying each message as a different log message:

```
"/api/v1/orders/220169524", client: 10.5.0.5, server: svr1-app-1..net, request: "GET /api/v1/orders/220169524?account_id=11139568 HTTP/1.0", host: "neptun.net"
2020/03/23 10:40:28 [notice] 3975#3975: *1227471 rewritten data: "/api/api.php", args: "service=/orders&id=/220169524&account_id=11139568", client: 10.5.0.5, server: svr1-app-1.net, request: "GET /api/v1/orders/220169524?account_id=11139568 HTTP/1.0", host: "neptun.net"
2020/03/23 10:40:28 [notice] 3975#3975: *1214340 "^/api/v1(/[a-zA-Z]+)?(/[a-zA-Z0-9]+)?$" matches "/api/v1/warehouseOrderLvsStatus/2719935", client: 10.2.32.6, server: svr1-app-1.net, request: "GET /api/v1/warehouseOrderLvsStatus/2719935?ID=614d3409df26ef98d3bade5837e43ec4 HTTP/2.0", host: "svr1.net", referrer: "https://svr1.net/admin.php?content=36;orderid=120054197;ID=614d3409df26ef98d3bade5837e43ec4"
2020/03/23 10:40:28 [notice] 3975#3975: *1214340 rewritten data: "/api/api.php", args: "service=/warehouseOrderLvsStatus&id=/2719935&ID=614d3409df26ef98d3bade5837e43ec4", client: 10.2.32.6, server: svr1-app-1..net, request: "GET /api/v1/warehouseOrderLvsStatus/2719935?ID=614d3409df26ef98d3bade5837e43ec4 HTTP/2.0", host: "svr1.net", referrer: "https://svr1..net/admin.php?content=36;orderid=120054197;ID=614d3409df26ef98d3bade5837e43ec4"
2020/03/23 10:40:28 [notice] 3975#3975: *1227478 "^/api/v1(/[a-zA-Z]+)?(/[a-zA-Z0-9]+)?$" matches "/api/v1/products", client: 10.5.0.5, server: svr1-app-1..net, request: "GET /api/v1/products?product_id=10154%2C85906%2C9005%2C333908%2C99836%2C6078%2C142886%2C159849;sort=-id;page=1;per_page=10 HTTP/1.0", host: "neptun.bike24.net"
2020/03/23 10:40:28 [notice] 3975#3975: *1227478 rewritten data: "/api/api.php", args: "service=/products&id=&product_id=10154%2C85906%2C9005%2C333908%2C99836%2C6078%2C142886%2C159849;sort=-id;page=1;per_page=10", client: 10.5.0.5, server: svr1-app-1..net, request: "GET /api/v1/products?product_id=10154%2C85906%2C9005%2C333908%2C99836%2C6078%2C142886%2C159849;sort=-id;page=1;per_page=10 HTTP/1.0", host: "neptun.bike24.net"
2020/03/23 10:40:29 [notice] 3975#3975: *1227318 "^/api/v1(/[a-zA-Z]+)?(/[a-zA-Z0-9]+)?$" matches "/api/v1/warehouseOrderLvsStatus/2750572", client: 10.8.0.234, server: svr1-app-1..net, request: "GET /api/v1/warehouseOrderLvsStatus/2750572?ID=9260d39740e481cfc80a903ffebc5fad HTTP/2.0", host: "svr1.net", referrer: "https://svr1..net/admin.php?orderid=220170654;content=36"

```

The block above appears as one message not on separate lines.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2020, 1:52pm UTC](https://discuss.elastic.co/t/logs-are-being-aggregated-not-separate-lines/224652/4 "2020-04-20T13:52:58Z")

</div>

Closed on April 20, 2020, 1:52pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.