# Multiline Logstah file txt **URL:** \ **Category:** Logstash\ **Created:** [August 3, 2020, 6:33pm UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613 "2020-08-03T18:33:44Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Daniel\_Bergmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_bergmann/32/46635_2.png) [@Daniel\_Bergmann](https://discuss.elastic.co/u/Daniel_Bergmann)\ **Post date:** [August 3, 2020, 6:33pm UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/1 "2020-08-03T18:33:44Z")
I have a TXT file that I want to import into Elasticsearch via LogStash, it is a fixed type of columns, in which I used grok and if to separate the columns of this file, that's fine, but I want to use the multiline to get 'n' lines that will be inserted / consolidated in the same document in Elastic. Each line of the file the first column is the type line, (it can be 1,2, or 3) and I would like to consolidate everything below 1 an event in the logstash, it closes the event when the next line is 1, it follows an example of lines in the txt file: LINE 1: 1 .... LINE 2: 2 .... LINE 3: 2 .... LINE 4: 3 .... LINE 5: 1 .... LINE 6: 1 .... LINE 7: 2 .... LINE 8: 1 .... in the output it would be like this: LINE 1, 2, 3, 4 - document elastic \_id LINE 5 - another document elastic \_id LINE 6 and 7 - another document elastic\_id LINE 8 - another document elastic\_id I have been researching but I can't find a correct pattern for this or not to do for Lostash but for a python reading the file and consolidating it into an array. Can someone help me ? Thank you Daniel ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 3, 2020, 7:33pm UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/2 "2020-08-03T19:33:04Z")
Are "LINE 1:" etc just labels in your example or do they actually exist in the data? Are you using a file input? If so, you might be able to do this with a multiline codec on the input. Alternatively an aggregate filter. ---
**Author:** ![Daniel\_Bergmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_bergmann/32/46635_2.png) [@Daniel\_Bergmann](https://discuss.elastic.co/u/Daniel_Bergmann)\ **Post date:** [August 3, 2020, 8:11pm UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/3 "2020-08-03T20:11:54Z")
Hi Badger, LINE 1: don´t exist only first column in line is (1,2 or 3) yes a using file input. Thank you ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 3, 2020, 8:42pm UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/4 "2020-08-03T20:42:34Z")
On the file input use ``` codec => multiline { pattern => '^1' negate => true what => previous auto_flush_interval => 1 } ``` then if you use mutate+split, with a literal newline in the configuration ``` mutate { split => { "message" => " " } } ``` you will get events like ``` { "@timestamp" => 2020-08-03T20:40:30.716Z, "@version" => "1", "message" => [ [0] "1 ....", [1] "2 ....", [2] "2 ....", [3] "3 ...." ], "tags" => [ [0] "multiline" ], "host" => "myhost, "path" => "/home/user/foo.txt" } ``` ---
**Author:** ![Daniel\_Bergmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_bergmann/32/46635_2.png) [@Daniel\_Bergmann](https://discuss.elastic.co/u/Daniel_Bergmann)\ **Post date:** [August 3, 2020, 11:54pm UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/5 "2020-08-03T23:54:39Z")
Thank you it´s work, How do I apply grok to each line of the array [0] [1] [2] to separate the fields ? Regards, Daniel ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 4, 2020, 12:37am UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/6 "2020-08-04T00:37:37Z")
I believe if you ask grok to match against a field that is an array it will iterate over the entries and try the pattern or patterns against each one. You may or may not like how it presents the results. I suggest you try it. ---
**Author:** ![Daniel\_Bergmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_bergmann/32/46635_2.png) [@Daniel\_Bergmann](https://discuss.elastic.co/u/Daniel_Bergmann)\ **Post date:** [August 4, 2020, 11:53am UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/7 "2020-08-04T11:53:30Z")
Thank you answer, but howto make ? how scan array ? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 1, 2020, 11:53am UTC](https://discuss.elastic.co/t/multiline-logstah-file-txt/243613/8 "2020-09-01T11:53:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.