# Logstash filter for multiple log files parsing

**URL:** <https://discuss.elastic.co/t/logstash-filter-for-multiple-log-files-parsing/76310>\
**Category:** Logstash\
**Created:** [February 23, 2017, 9:26pm UTC](https://discuss.elastic.co/t/logstash-filter-for-multiple-log-files-parsing/76310 "2017-02-23T21:26:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sam281](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@sam281](https://discuss.elastic.co/u/sam281)\
**Post date:** [February 23, 2017, 9:26pm UTC](https://discuss.elastic.co/t/logstash-filter-for-multiple-log-files-parsing/76310/1 "2017-02-23T21:26:55Z")

</div>

Hi,

I have file beats sending data to logstash. I am trying to filter and parse the log records based on the source file.

On kibana I see a field called "source" which has the source log file name for each record, I would like to leverage this field and write the parsing in logstash.

This is what i tried in logstash.conf which seems it is not working and logstash failed to start. Any pointers are highly appreciated. Thank you for your help!

filter{

```
if [source] = "/opt/IBM/log/SPI.log" {
	grok {
		match => { "message" => "%{TIMESTAMP_ISO8601:ibmtime}: %{LOGLEVEL:severity}: %{DATA:messageid}: %{GREEDYDATA:message}"}
		overwrite => ["message"]
	}
}

```

}

---

<div class="post-metadata">

**Author:** ![sam281](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@sam281](https://discuss.elastic.co/u/sam281)\
**Post date:** [February 23, 2017, 9:38pm UTC](https://discuss.elastic.co/t/logstash-filter-for-multiple-log-files-parsing/76310/2 "2017-02-23T21:38:55Z")

</div>

Here is the command output that I see when I try to run the logstash manually.

C:\ELK-Stack\logstash\bin\>logstash -f ..\logstash.conf  
io/console not supported; tty will not be manipulated  
Settings: Default pipeline workers: 4  
←[31mPipeline aborted due to error {:exception=\>#\<Errno::EADDRINUSE: Address alr  
eady in use - bind - Address already in use: bind\>, :backtrace=\>["org/jruby/ext/  
socket/RubyTCPServer.java:118:in `initialize'", "org/jruby/RubyIO.java:853:in`n  
ew'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2  
.2.8/lib/lumberjack/beats/server.rb:51:in `initialize'", "C:/ELK-Stack/logstash/ vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.8/lib/logstash/inputs/beat s.rb:119:in`register'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/log  
stash-core-2.3.2-java/lib/logstash/pipeline.rb:330:in `start_inputs'", "org/jrub y/RubyArray.java:1613:in`each'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9  
/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:329:in `start_inputs'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib /logstash/pipeline.rb:180:in`start\_workers'", "C:/ELK-Stack/logstash/vendor/bun  
dle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:136:in `run '", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java /lib/logstash/agent.rb:465:in`start\_pipeline'"], :level=\>:error}←[0m  
stopping pipeline {:id=\>"main"}  
←[33mAn unexpected error occurred! {:error=\>#\<NoMethodError: undefined method `e ach' for nil:NilClass>, :class=>"NoMethodError", :backtrace=>["C:/ELK-Stack/logs tash/vendor/bundle/jruby/1.9/gems/logstash-input-beats-2.2.8/lib/logstash/inputs /beats.rb:188:in`stop'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/lo  
gstash-core-2.3.2-java/lib/logstash/inputs/base.rb:83:in `do_stop'", "org/jruby/ RubyArray.java:1613:in`each'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/g  
ems/logstash-core-2.3.2-java/lib/logstash/pipeline.rb:385:in `shutdown'", "C:/EL K-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logst ash/agent.rb:411:in`stop\_pipeline'", "C:/ELK-Stack/logstash/vendor/bundle/jruby  
/1.9/gems/logstash-core-2.3.2-java/lib/logstash/agent.rb:404:in `shutdown_pipeli nes'", "org/jruby/RubyHash.java:1342:in`each'", "C:/ELK-Stack/logstash/vendor/b  
undle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/agent.rb:404:in `shut down_pipelines'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-c ore-2.3.2-java/lib/logstash/agent.rb:400:in`shutdown'", "C:/ELK-Stack/logstash/  
vendor/bundle/jruby/1.9/gems/logstash-core-2.3.2-java/lib/logstash/agent.rb:229:  
in `execute'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core -2.3.2-java/lib/logstash/runner.rb:94:in`run'", "org/jruby/RubyProc.java:281:in  
`call'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3. 2-java/lib/logstash/runner.rb:99:in`run'", "org/jruby/RubyProc.java:281:in `cal l'", "C:/ELK-Stack/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/ta sk.rb:24:in`initialize'"], :level=\>:warn}←[0m  
The signal HUP is in use by the JVM and will not work correctly on this platform

C:\ELK-Stack\logstash\bin\>

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 24, 2017, 1:50am UTC](https://discuss.elastic.co/t/logstash-filter-for-multiple-log-files-parsing/76310/3 "2017-02-24T01:50:16Z")

</div>

> [@sam281](#):
>
> bind - Address already in use: bind

Showing your entire config would be useful, it might highlight what is causing this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2017, 1:50am UTC](https://discuss.elastic.co/t/logstash-filter-for-multiple-log-files-parsing/76310/4 "2017-03-24T01:50:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.