# Logstash- transfrom multiple log lines to one line

**URL:** https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376
**Category:** Logstash
**Created:** [March 3, 2016, 12:14pm UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376 "2016-03-03T12:14:16Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Atul\_Patel](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)
#### Post date: [March 3, 2016, 12:14pm UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376/1 "2016-03-03T12:14:16Z")

</div>

I have a situation where I am getting logs from forwarder in the below format:

```
timestamp <uniquerID> entry: ProcessAPI{AddEmployee} :hostname
timestamp <uniquerID> send: UserAPI{ValidateUser} :hostname
timestamp <uniquerID> receive: UserAPI{ValidateUser} :hostname
timestamp <uniquerID> send: AccountAPI{ValidateAccount} :hostname
timestamp <uniquerID> receive: AccountAPI{ValidateAccount} :hostname
timestamp <uniquerID> exit: ProcessAPI{AddEmployee} :hostname

```

I want to combine these log line to a single line like below format:

```
timestamp <uniquerID> Exit:ProcessAPI{AddEmployee}:hostname | UserAPI{ValidateUser}:hostname | AccountAPI{ValidateAccount}:hostname 

```

Is there a way in Logstash to do this.?

Update: Each log line has associated parent service name in the source field as below:

@Source: ProcessAPI{AddEmployee}  
@Message : timestamp send: UserAPI{ValidateUser} :hostname

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 3, 2016, 12:16pm UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376/2 "2016-03-03T12:16:01Z")

</div>

Look at the multiline codec.

---

<div class="post-metadata">

### Author: ![Atul\_Patel](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)
#### Post date: [March 3, 2016, 12:27pm UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376/3 "2016-03-03T12:27:14Z")

</div>

Hi  
Is multline is threadsafe.I am seeing from the Logstash info stating that multiline is not thread safe.

We need a solid solution to concat these either using multiline,merge or aggregate

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 3, 2016, 12:31pm UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376/4 "2016-03-03T12:31:00Z")

</div>

The current multiline codec documentation says nothing about thread safety.

---

<div class="post-metadata">

### Author: ![Atul\_Patel](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)
#### Post date: [March 3, 2016, 12:42pm UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376/5 "2016-03-03T12:42:41Z")

</div>

HI  
Is multiline will be achieved for where we have many logs like this coming from different services

---

<div class="post-metadata">

### Author: ![Atul\_Patel](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Atul\_Patel](https://discuss.elastic.co/u/Atul_Patel)
#### Post date: [March 3, 2016, 12:46pm UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376/6 "2016-03-03T12:46:16Z")

</div>

I tried Multiline codec , but its combining the whole logs to an array.

The scenario here is that I have same types of logs coming from many services in bulk.

Example :  
Service A calling --\> Service B

So logs for both service A as well as service B will be shipped to logstash simultaneously.

How would I combine logs of service A as single line and logs for Service B as another single line.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:08am UTC](https://discuss.elastic.co/t/logstash-transfrom-multiple-log-lines-to-one-line/43376/7 "2017-07-06T05:08:35Z")

</div>