# Logstash/Kibana breaks my log line into multiple events/documets **URL:** \ **Category:** Logstash\ **Created:** [August 9, 2017, 9:36pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517 "2017-08-09T21:36:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 9, 2017, 9:36pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/1 "2017-08-09T21:36:27Z")
Its strange though, Logstash/kibana is breaking my single log line into multiple events/documents. Whereas it should be a single event , otherwise it doesnt solve my purpose to even put these logs into ELK. Any idea? how this can be fixed. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 10, 2017, 6:04am UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/2 "2017-08-10T06:04:12Z")
How could we possibly help without knowing what your configuration and log entries look like? ---
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 10, 2017, 2:41pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/3 "2017-08-10T14:41:57Z")
Sorry about the incomplete info: Here is the logstash config input { beats { port =\> 9997 } } filter { if [fields][source] == “monic\_tomcat\_perf” { ``` grok { match => {"message" => "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME},%{NUMBER:duration} %{WORD:loglevel} %{WORD:Activity} \[\{%{DATA:foo1}\}\]:(.*) execution time: %{NUMBER:executionTime:float} ms"} } kv { source => "foo1" field_split => ", " } mutate { remove_field => ["foo1"] } ``` } else if [fields][source] == "monic\_web\_log" { grok { match =\> {"message" =\> "(%{COMMONAPACHELOG})? Client-Correlation-Id=%{NOTSPACE:id} ResponseSecs=%{NUMBER:responsesecs} ResponseMicros=%{NUMBER:responseMicros} ("%{URI:url}")? %{GREEDYDATA:device}"} } } ``` else if [fields][source] == "monic_tomcat_app" { grok { match => {"message" => "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME},%{NUMBER:duration} %{WORD:loglevel}%{SPACE}%{WORD:Activity} \[\{(%{DATA:foo1})?\}\]: %{GREEDYDATA:foo2} User=\"Associate\(%{DATA:foo3}\)\""} } kv { source => "foo1" field_split => ", " } kv { source => "foo2" field_split => " " } kv { source => "foo3" field_split => ", " } ``` } } output { elasticsearch { hosts =\> “localhost:9200” #manage\_template =\> false index =\> harmonic\_dev user =\> elastic password =\> elasticpassword } stdout { codec =\> rubydebug} } This the log file line that i injested for reproducing this issue, the output which i see in Kibana is truncated. In the screenshot i am attaching, the first event i am talking about with latest time stamp. [%t] 08 Aug 2017 18:55:38,203 INFO HomeBaseApiConsumer [{applicationSystemCode=monicapp-app, clientIP=10.218.87.153, clusterId=Cluster-Id-NA, containerId=Container-Id-NA, correlationId=205c2806-2f97-f42f-00f5-9a43aafb9eb3, domainName=defaultDomain, [hostName=ip-202-100-x.domain.com](http://hostName=ip-202-100-x.domain.com), messageId=10.202.100.34-4041d41d-75f3-4282-9aab-dd1ab17ecdf3, userId=ANONYMOUS, webAnalyticsCorrelationId=B347BC083EB9DCE4ED5005506F1F1E63|}]: KpiMetric=“Cta” TransactionName=“ApplicationDetail” TransactionStatus=“Success” User=“Associate(firstName=mike, lastName=henry, role=Consultant, [email=mike@domain.com](mailto:email=mike@domain.com), electronicId=M422)”. Also i dont see the fields being parsed by logstash, it should have invoked the condition else if [source][fields] = “monic\_tomcat\_app” Not sure if my conditional statements are wrong. But two summarise the issues Kibana truncating the output whereas logstash shoes full message on STDOUT Fields are not being parsed and no GROk failure error. ![Broken Events](https://us1.discourse-cdn.com/elastic/original/3X/3/0/309f36e5d08a70e4b36582576414b187ed063128.JPG) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 10, 2017, 3:02pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/4 "2017-08-10T15:02:05Z")
Don't post screenshots. Expand an event, switch to the JSON tab, and copy the raw text from there instead. What does your Filebeat configuration look like? **Make sure you post it as preformatted text so it doesn't get mangled.** ---
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 10, 2017, 4:12pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/5 "2017-08-10T16:12:36Z")
This is the filebeat.yml - input\_type: log I am adding few test lines into this file only . ---
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 10, 2017, 4:15pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/6 "2017-08-10T16:15:29Z")
Basically logstash is not all looking at my GROK filters. ---
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 10, 2017, 5:35pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/7 "2017-08-10T17:35:10Z")
I was able to change the setting( truncate:maxHeight) on kibana to 0. and fixed the filebeat.yml file . Everything looks perfect now. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 7, 2017, 5:35pm UTC](https://discuss.elastic.co/t/logstash-kibana-breaks-my-log-line-into-multiple-events-documets/96517/8 "2017-09-07T17:35:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.