# Merge multiple lines into one with Filebeat

**URL:** <https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 5, 2016, 1:15pm UTC](https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352 "2016-08-05T13:15:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![theopiboubes](https://avatars.discourse-cdn.com/v4/letter/t/7c8e57/32.png) [@theopiboubes](https://discuss.elastic.co/u/theopiboubes)\
**Post date:** [August 5, 2016, 1:15pm UTC](https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352/1 "2016-08-05T13:15:15Z")

</div>

Hi!

I have a Filebeat instance running along with a Logstash server, to which Filebeat data is forwarded.  
Before sending data to Logstash, I want to merge certain lines of the watched log file together.

For example, I have this data:  
`sudo[3]: ...session opened... sudo[3]: ...session closed... sshd[19]: authentication failure... sshd[19]: authentication success...`

The two `sudo` lines are two distinct log messages, but they are still related, because of the number between the square brackets for example. Same for sshd. Is there a way to merge the sudo lines (or sshd lines) so that only one message would be forwarded to Logstash, instead of one for each line? Or, more generally, merge lines that have a value in common?

I've looked into the multiline option, but it doesn't seem to be exactly what I'm looking for, as it seems more adapted to unique log entries that take multiple lines. This is not exactly my case here.

Can somebody help me please?  
Thanks in advance  
Théo

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 6, 2016, 5:33am UTC](https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352/2 "2016-08-06T05:33:16Z")

</div>

You can't do this with beats, you need to send to LS and use [https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html)

---

<div class="post-metadata">

**Author:** ![theopiboubes](https://avatars.discourse-cdn.com/v4/letter/t/7c8e57/32.png) [@theopiboubes](https://discuss.elastic.co/u/theopiboubes)\
**Post date:** [August 10, 2016, 8:59am UTC](https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352/3 "2016-08-10T08:59:51Z")

</div>

Yeah, I actually have seen this Logstash plugin, but for some reason it cannot be used with my setup, so I wanted to see if there was a way to do it with Filebeat nonetheless. I'll just try and find another way. Thank you for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2016, 1:15pm UTC](https://discuss.elastic.co/t/merge-multiple-lines-into-one-with-filebeat/57352/4 "2016-08-26T13:15:21Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.