# Multiple Logfiles from diffrent ClusterNodes to one merged Logfile

**URL:** https://discuss.elastic.co/t/multiple-logfiles-from-diffrent-clusternodes-to-one-merged-logfile/43344
**Category:** Logstash
**Created:** [March 3, 2016, 7:37am UTC](https://discuss.elastic.co/t/multiple-logfiles-from-diffrent-clusternodes-to-one-merged-logfile/43344 "2016-03-03T07:37:11Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![mehrentraut](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@mehrentraut](https://discuss.elastic.co/u/mehrentraut)
#### Post date: [March 3, 2016, 7:37am UTC](https://discuss.elastic.co/t/multiple-logfiles-from-diffrent-clusternodes-to-one-merged-logfile/43344/1 "2016-03-03T07:37:11Z")

</div>

Hi,

i hope someone can help me.

I want merge/aggregate logfiles from diffrent Clusternodes to one Logfile on logfile Storage.

Currently I use log / slog, but this is no longer being developed. I evaluate the index and the logfiles already Elasticsearch and Logstash use, I am now seeking to aggregate the files with logstash a possibility.  
It is important that the log files are put together in the correct sequence.

So far I have found no such Logstash plugin or an appropriate documentation.

Thanks to all the help or even try.

Martin

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 3, 2016, 8:19am UTC](https://discuss.elastic.co/t/multiple-logfiles-from-diffrent-clusternodes-to-one-merged-logfile/43344/2 "2016-03-03T08:19:25Z")

</div>

> It is important that the log files are put together in the correct sequence.

What does this mean, specifically? That the events in a particular input file end up in the same order in the output file, or that _all_ events from an input file are laid out consecutively in the output file? In other words, given these input files:

fileA:

```plaintext
A1
A2
A3

```

fileB:

```plaintext
B1
B2
B3

```

Would

```plaintext
B1
A1
A2
B2
A3
B3

```

be okay in the output file or do you need this:

```plaintext
A1
A2
A3
B1
B2
B3

```

Logstash has many input plugins that you can use to collect data from your machines, and the file output plugin can write some or all of those events to files. It's not clear why that wouldn't be sufficient in your case.

---

<div class="post-metadata">

### Author: ![mehrentraut](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@mehrentraut](https://discuss.elastic.co/u/mehrentraut)
#### Post date: [March 3, 2016, 8:58am UTC](https://discuss.elastic.co/t/multiple-logfiles-from-diffrent-clusternodes-to-one-merged-logfile/43344/3 "2016-03-03T08:58:20Z")

</div>

HI Magnus,

i need

> A1  
> B1  
> C1  
> D1  
> F1  
> A2  
> B2  
> D2

Decisive for the arrangement of the timestamp is in file. If I have in 5 seconds 10 entries in the log file A and only 1 in the log file B then should all look like this later.

> 00:01:01A1  
> 00:01:02A1  
> 00:01:03A1  
> 00:01:04B1  
> 00:01:05A1  
> 00:01:06A1

I hope I have made myself clear

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 3, 2016, 12:14pm UTC](https://discuss.elastic.co/t/multiple-logfiles-from-diffrent-clusternodes-to-one-merged-logfile/43344/4 "2016-03-03T12:14:56Z")

</div>

Oh, okay. There are no stock plugins in Logstash to do this.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:08am UTC](https://discuss.elastic.co/t/multiple-logfiles-from-diffrent-clusternodes-to-one-merged-logfile/43344/5 "2017-07-06T05:08:35Z")

</div>


