# Logstash combining logs from multiple sources

**URL:** <https://discuss.elastic.co/t/logstash-combining-logs-from-multiple-sources/147944>\
**Category:** Logstash\
**Created:** [September 10, 2018, 11:04am UTC](https://discuss.elastic.co/t/logstash-combining-logs-from-multiple-sources/147944 "2018-09-10T11:04:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Telstra\_Aus](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\
**Post date:** [September 10, 2018, 11:04am UTC](https://discuss.elastic.co/t/logstash-combining-logs-from-multiple-sources/147944/1 "2018-09-10T11:04:45Z")

</div>

Hi,

Scenario: We are trying to scan post execution logs from filebeat and feeding it to logstash to get them in elasticsearch.

Problem: Logstash is combining logs from different location/sources in one document.

Artefacts: PFA the Screenshot, Below is the Json of the document.

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/9/3/935673b3c6ff623efc9a791f2b426be055e8fe81.jpeg)

Json:  
{  
"\_index": "lrlogs-2018.09.10",  
"\_type": "LR\_Post\_execution\_Logs",  
"\_id": "AWXDEudNg23FnpmIN\_qt",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"offset": [  
1859,  
842,  
1519,  
2911,  
572,  
2686,  
3714  
],  
"input\_type": "log",  
"source": [  
"\\Sgbnftapp04\nft\R1\SWP51\Results\ELK021193\log\Search\_Contact\_44.log",  
"\\Sgbnftapp04\nft\R1\SWP51\Results\ELK021193\log\Maxis\_R1\_Swap51\_ViewbalanceAndServices\_9.log",  
"\\Sgbnftapp04\nft\R1\SWP51\Results\ELK021193\log\Maxis\_R1\_OMS\_ResumeOrder\_5.log",  
"\\Sgbnftapp04\nft\R1\SWP51\Results\ELK021193\log\Maxis\_R1\_OMS\_CeaseOrde\_5.log",  
"\\Sgbnftapp04\nft\R1\SWP51\Results\ELK021193\log\CreateContact\_v1\_23.log",  
"\\Sgbnftapp04\nft\R1\SWP51\Results\ELK021193\log\Provide\_Jvuser\_Final\_v4\_18.log",  
"\\Sgbnftapp04\nft\R1\SWP51\Results\ELK021193\log\EditProfile\_new\_6.log"  
],  
"message": "Start auto log messages stack - Iteration 144.\t[MsgId: MMSG-10545]\nAction2.c(376): Warning -26628: HTTP Status-Code=403 (Forbidden) for "[http://10.218.15.243/rp-server/commerce/customer/50077978/product?salesChannel=MC&lo=en\_US&productId=1000050540](http://10.218.15.243/rp-server/commerce/customer/50077978/product?salesChannel=MC&lo=en_US&productId=1000050540)" [issued at Action2.c(385)] \t[MsgId: MWAR-26628]\nNotify: Transaction "R1\_OMS\_ResumeOrder\_01\_Click\_On\_Search\_Assign\_Product" started.\t[MsgId: MMSG-16999]\nNotify: Transaction "R1\_OMS\_CeaseOrder\_09\_Search\_By\_OrderID" started.\t[MsgId: MMSG-16999]\nAction4.c(150): lr\_think\_time: 1.00 seconds (recorded think time was 2.00 seconds).\t[MsgId: MMSG-15947]\nNotify: Transaction "Maxis\_R1\_OMS\_ProvideOrder\_13\_SubmitOrder" ended with a "Pass" status (Duration: 0.3779).\t[MsgId: MMSG-16873]\nAction1.c(104): Warning -26612: HTTP Status-Code=500 (Internal Server Error) for "[http://10.218.15.243/rp-server/care/customer/50124792?salesChannel=MC&lo=en\_US&preOrderEligibility=true](http://10.218.15.243/rp-server/care/customer/50124792?salesChannel=MC&lo=en_US&preOrderEligibility=true)" \t[MsgId: MWAR-26612]",  
"type": "log",  
"tags": [  
"beats\_input\_codec\_plain\_applied",  
"multiline"  
],  
"@timestamp": "2018-09-10T10:41:56.721Z",  
"@version": "1",  
"beat": {  
"name": "SGBNFTAPP07",  
"hostname": "SGBNFTAPP07",  
"version": "5.6.3"  
},  
"host": "SGBNFTAPP07",  
"fields": {  
"log\_type": [  
"LR\_PostExecutionLogs\_CRM\_Search\_Contact",  
"LR\_PostExecutionLogs\_Digital\_ViewbalanceAndServices",  
"LR\_PostExecutionLogs\_OMS\_ResumeOrder",  
"LR\_PostExecutionLogs\_OMS\_CeaseOrder",  
"LR\_PostExecutionLogs\_RM\_GUI\_CreateContact",  
"LR\_PostExecutionLogs\_OMS\_Provide\_Order\_GUI",  
"LR\_PostExecutionLogs\_Digital\_EditProfile"  
]  
}  
},  
"fields": {  
"@timestamp": [  
1536576116721  
]  
},  
"sort": [  
1536576116721  
]  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 11, 2018, 8:49pm UTC](https://discuss.elastic.co/t/logstash-combining-logs-from-multiple-sources/147944/2 "2018-09-11T20:49:22Z")

</div>

What do your Logstash and Filebeat configurations look like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2018, 8:49pm UTC](https://discuss.elastic.co/t/logstash-combining-logs-from-multiple-sources/147944/3 "2018-10-09T20:49:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.