# Logstash merge event,need help!

**URL:** https://discuss.elastic.co/t/logstash-merge-event-need-help/88033
**Category:** Logstash
**Created:** [June 2, 2017, 8:34am UTC](https://discuss.elastic.co/t/logstash-merge-event-need-help/88033 "2017-06-02T08:34:11Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JIELOGAN](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@JIELOGAN](https://discuss.elastic.co/u/JIELOGAN)
#### Post date: [June 2, 2017, 8:34am UTC](https://discuss.elastic.co/t/logstash-merge-event-need-help/88033/1 "2017-06-02T08:34:11Z")

</div>

Hi ,I want to merge some events ,but i did not find any plugin could [work.My](http://work.My) data like this:  
H Comware Platform Software  
Comware Software, Version 5.20, Release 2202  
Copyright (c) 2004-2009 Hhu.  
H S-C-E uptime is 77 weeks, 3 days, 20 hours, 57 minutes  
I want to merge the 2rd line and 4th line:  
Comware Software, Version 5.20, Release 2202 H S-C-E uptime is 77 weeks, 3 days, 20 hours, 57 minutes  
How can i make it work ? Please

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [June 2, 2017, 10:38am UTC](https://discuss.elastic.co/t/logstash-merge-event-need-help/88033/2 "2017-06-02T10:38:06Z")

</div>

What does your config look like?

We have to know where you are getting your data from because then we can suggest multiline etc so that you can get those lines into one event.

If you have multiple events, one per line, then your question becomes near to impossible to solve.

LS does not **guarantee** event ordering - worker threads can be working on events in parallel and each filter treats each event as if its never seen any previous events.

---

<div class="post-metadata">

### Author: ![JIELOGAN](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@JIELOGAN](https://discuss.elastic.co/u/JIELOGAN)
#### Post date: [June 15, 2017, 4:25am UTC](https://discuss.elastic.co/t/logstash-merge-event-need-help/88033/3 "2017-06-15T04:25:27Z")

</div>

THANKS，I got logs from H3C device,and lots of data is useless, I just need some of it. but what i need it is not continuous, so i want to extract some line to merge. is this could work? or use some other tool?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2017, 4:25am UTC](https://discuss.elastic.co/t/logstash-merge-event-need-help/88033/4 "2017-07-13T04:25:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.