# Logstash - Merge multiple lines into one event
**URL:** https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573
**Category:** Logstash
**Created:** [May 19, 2018, 4:17pm UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573 "2018-05-19T16:17:14Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)
#### Post date: [May 19, 2018, 4:17pm UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573/1 "2018-05-19T16:17:14Z")
Hi,
I want to create one configuration file for logstash such that it should generate an event and upload a whole message whatever is there in one timestamp to other timestamp.
Can anyone please help me how to achieve this.
Here is my log as shown below:
10-05-2018 00:00:00.0031 DEBUG Thd: 6540 [Schedule] (checkSchedules) Chequea a: 10/05/2018 12:00:00 AM ON 10/05/2018 12:00:00 AM
10-05-2018 00:00:00.0031 DEBUG Thd: 6540 [Schedule] (checkSchedules) ThreadFinished: 00:00:00
10-05-2018 00:00:01.1904 ERROR Thd: 6568 192.168.56.1 [ManagedObject] (EntityLoad) Object not be loaded 192.168.56.1 AGENT
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
10-05-2018 00:00:01.1904 ERROR Thd: 6568 [ObjectServer] (GetManagedObject) Object can not be load: 192.168.56.1
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.MAgentObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.ObjectFactory.GetManagedObject(String oid, String objectClass, Boolean isFromWeb)
10-05-2018 00:00:01.2373 ERROR Thd: 6568 [ObjectServer] (processEvent) Exception Object reference not set to an instance of an object.
System.NullReferenceException: Object reference not set to an instance of an object.
at Adecef.TelgatNGOSS.ObjectServer.EventReportManager.processEvent(Object taskInfo)
10-05-2018 00:00:08.6432 ERROR Thd: 6568 192.168.56.1 [ManagedObject] (EntityLoad) Object not be loaded 192.168.56.1 AGENT
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
10-05-2018 00:00:08.6432 ERROR Thd: 6568 [ObjectServer] (GetManagedObject) Object can not be load: 192.168.56.1
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.MAgentObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.ObjectFactory.GetManagedObject(String oid, String objectClass, Boolean isFromWeb)
10-05-2018 00:00:09.5814 ERROR Thd: 6568 [ObjectServer] (processEvent) Exception Object reference not set to an instance of an object.
System.NullReferenceException: Object reference not set to an instance of an object.
at Adecef.TelgatNGOSS.ObjectServer.EventReportManager.processEvent(Object taskInfo)
10-05-2018 00:00:11.2221 ERROR Thd: 7156 192.168.56.1 [ManagedObject] (EntityLoad) Object not be loaded 192.168.56.1 AGENT
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
10-05-2018 00:00:11.2221 ERROR Thd: 7156 [ObjectServer] (GetManagedObject) Object can not be load: 192.168.56.1
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.MAgentObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.ObjectFactory.GetManagedObject(String oid, String objectClass, Boolean isFromWeb)
10-05-2018 00:00:11.2221 ERROR Thd: 7156 [ObjectServer] (processEvent) Exception Object reference not set to an instance of an object.
System.NullReferenceException: Object reference not set to an instance of an object.
at Adecef.TelgatNGOSS.ObjectServer.EventReportManager.processEvent(Object taskInfo)
10-05-2018 00:00:16.4403 ERROR Thd: 7156 192.168.56.1 [ManagedObject] (EntityLoad) Object not be loaded 192.168.56.1 AGENT
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
10-05-2018 00:00:16.4403 ERROR Thd: 7156 [ObjectServer] (GetManagedObject) Object can not be load: 192.168.56.1
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.MAgentObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.ObjectFactory.GetManagedObject(String oid, String objectClass, Boolean isFromWeb)
10-05-2018 00:00:16.4564 ERROR Thd: 7156 [ObjectServer] (processEvent) Exception Object reference not set to an instance of an object.
System.NullReferenceException: Object reference not set to an instance of an object.
at Adecef.TelgatNGOSS.ObjectServer.EventReportManager.processEvent(Object taskInfo)
10-05-2018 00:00:21.3002 ERROR Thd: 6568 192.168.56.1 [ManagedObject] (EntityLoad) Object not be loaded 192.168.56.1 AGENT
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
10-05-2018 00:00:21.3002 ERROR Thd: 6568 [ObjectServer] (GetManagedObject) Object can not be load: 192.168.56.1
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.MAgentObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.ObjectFactory.GetManagedObject(String oid, String objectClass, Boolean isFromWeb)
10-05-2018 00:00:21.3314 ERROR Thd: 6568 [ObjectServer] (processEvent) Exception Object reference not set to an instance of an object.
System.NullReferenceException: Object reference not set to an instance of an object.
at Adecef.TelgatNGOSS.ObjectServer.EventReportManager.processEvent(Object taskInfo)
10-05-2018 00:00:24.7846 INFO Thd: 5676 [Schedule] (mQueuedScheduleTimer\_Elapsed) Chequea QueuedSchedules: 10/05/2018 12:00:24 AM
10-05-2018 00:00:24.8011 INFO Thd: 5676 [QueueCalls] (SelectPendingCalls) Queue Length: 0. Start checking resources by queue...
10-05-2018 00:00:24.8011 INFO Thd: 5676 [QueueCalls] (SelectPendingCalls) ...End checking resources by queue.
10-05-2018 00:00:26.2221 ERROR Thd: 6568 192.168.56.1 [ManagedObject] (EntityLoad) Object not be loaded 192.168.56.1 AGENT
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
10-05-2018 00:00:26.2221 ERROR Thd: 6568 [ObjectServer] (GetManagedObject) Object can not be load: 192.168.56.1
Adecef.TelgatNGOSS.ObjectServer.ManagedObjectException: instance does not exists
at Adecef.TelgatNGOSS.ObjectServer.ManagedObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.MAgentObject.EntityLoad()
at Adecef.TelgatNGOSS.ObjectServer.ObjectFactory.GetManagedObject(String oid, String objectClass, Boolean isFromWeb)
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 19, 2018, 7:54pm UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573/2 "2018-05-19T19:54:08Z")
Which lines do you want to combine?
---
### Author:  [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)
#### Post date: [May 21, 2018, 4:52am UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573/3 "2018-05-21T04:52:01Z")
Hi @Badger, @magnusbaeck
I want to combine lines which are there between two timestamp.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 21, 2018, 1:32pm UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573/4 "2018-05-21T13:32:22Z")
If you want to combine multiple lines of a stack trace then use a [multiline codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html). The documentation includes an example for a Java stack trace.
---
### Author:  [@Sunillinus](https://discuss.elastic.co/u/Sunillinus)
#### Post date: [May 22, 2018, 11:57am UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573/5 "2018-05-22T11:57:06Z")
Hi @Badger
I have used multiline codec, but its not working as expected, I mean it is taking all lines between two lines, only it is taking 2 or 3 lines. And remaining lines are going with next event.
This is configuration file:
input {
file {
path =\> ["D:/Sample/\*"]
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
codec =\> multiline {
pattern =\> "^(\s)"
what =\> "previous"
}
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "sample-%{+YYYY.MM.dd}"
}
stdout {}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 22, 2018, 12:26pm UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573/6 "2018-05-22T12:26:07Z")
The same as [this](https://discuss.elastic.co/t/logstash-parsing-log-messages/132630/3). Please do not start multiple threads for exactly the same issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 19, 2018, 12:26pm UTC](https://discuss.elastic.co/t/logstash-merge-multiple-lines-into-one-event/132573/7 "2018-06-19T12:26:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.