# Multiline log - How to parse?
**URL:** https://discuss.elastic.co/t/multiline-log-how-to-parse/161414
**Category:** Logstash
**Created:** [December 18, 2018, 9:09pm UTC](https://discuss.elastic.co/t/multiline-log-how-to-parse/161414 "2018-12-18T21:09:27Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@hueyg](https://discuss.elastic.co/u/hueyg)
#### Post date: [December 18, 2018, 9:09pm UTC](https://discuss.elastic.co/t/multiline-log-how-to-parse/161414/1 "2018-12-18T21:09:28Z")
Have several beats now working, but running up against this trainwreck of a log. My understanding is that since I have several beats going I need to "transform" the log on the filebeat side before it gets shipped out?
Honestly I am not even sure how to start if it is even possible. Below is an example of the log:
I had to post the log in a picture format because the forum software was applying some formatting I could not remove.
This terrible structure list events in blocks or paragraphs. Each unique event is preceded by a new blank line, next line, several spaces then the 389-Directory header portion. To make matters worse, each block has the possibility of extra events which are denoted by a preceding -
I am still recovering from my tour with Grok filters, so I am kind of looking for a little hand holding here to get started.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2019, 9:20pm UTC](https://discuss.elastic.co/t/multiline-log-how-to-parse/161414/2 "2019-01-15T21:20:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.