# Multiple Segments logs Collection **URL:** \ **Category:** Logstash\ **Created:** [August 24, 2015, 4:43pm UTC](https://discuss.elastic.co/t/multiple-segments-logs-collection/27962 "2015-08-24T16:43:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![puneet2607](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@puneet2607](https://discuss.elastic.co/u/puneet2607)\ **Post date:** [August 24, 2015, 4:43pm UTC](https://discuss.elastic.co/t/multiple-segments-logs-collection/27962/1 "2015-08-24T16:43:53Z")
Hi, I am a newbie, I am planning to use Logstash for collecting multiple segments logs listening over TCP. Example log format with 23 segments are below: \<181\>Jun 29 14:41:37 server1 CM\_Passed\_Authentications 0000000001 23 0 2015-06-29 14:41:37.881 +05:30 0019694780 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=143, \<181\>Jun 29 14:41:37 server1 CM\_Passed\_Authentications 0000000001 23 1 Device IP Address=10.20.30.40, DestinationIPAddress=50.60.70.80, DestinationPort=1234, UserName=a1-b2-c3-n4, \<181\>Jun 29 14:41:37 server1 CM\_Passed\_Authentications 0000000001 23 2 Protocol=http, RequestLatency=6, NetworkDeviceName=mobile, User-Name=xyz, NAS-IP-Address=1.2.3.4, . . . \<181\>Jun 29 14:41:37 server1 CM\_Passed\_Authentications 0000000001 23 22 ir=profile-name=xyz; }, I want to collect as single log entry by parsing and formatting text with time stamp, other header information and message body. I checked couple of forums but couldn't find a solution which fits my requirement. Can someone help me on the same? Thanks, Puneet Garg ---
**Author:** ![michaellizhou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michaellizhou/32/4143_2.png) [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Post date:** [August 24, 2015, 8:41pm UTC](https://discuss.elastic.co/t/multiple-segments-logs-collection/27962/2 "2015-08-24T20:41:45Z")
So you are trying to multiline them together? Does this fit if log begins with serve1 CM\_Passes\_Authentication group them together? ---
**Author:** ![puneet2607](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@puneet2607](https://discuss.elastic.co/u/puneet2607)\ **Post date:** [August 25, 2015, 4:59am UTC](https://discuss.elastic.co/t/multiple-segments-logs-collection/27962/3 "2015-08-25T04:59:15Z")
> [@puneet2607](#): > > \<181\>Jun 29 14:41:37 server1 CM\_Passed\_Authentications 0000000001 23 Thanks for your reply. No, That's not the part by which we can group by. It can be group by with below header in current case \<181\>Jun 29 14:41:37 server1 CM\_Passed\_Authentications 0000000001 23 But all info will be changing and coming dynamically for other logs. Thanks, Puneet ---
**Author:** ![puneet2607](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@puneet2607](https://discuss.elastic.co/u/puneet2607)\ **Post date:** [August 26, 2015, 12:28pm UTC](https://discuss.elastic.co/t/multiple-segments-logs-collection/27962/4 "2015-08-26T12:28:25Z")
Hi Michael, I see in my logs I have 0000000001 common. Can I write a codec or filter pattern to check that ID to group logs? If yes, please suggest some sample based on my logs structure. Thanks, Puneet Garg ---
**Author:** ![puneet2607](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@puneet2607](https://discuss.elastic.co/u/puneet2607)\ **Post date:** [August 27, 2015, 11:23am UTC](https://discuss.elastic.co/t/multiple-segments-logs-collection/27962/5 "2015-08-27T11:23:04Z")
Hi Michael, Just to update I used aggregate filters to achieve my use case. Thanks for your reply. Regards, Puneet Garg ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/multiple-segments-logs-collection/27962/6 "2017-07-06T05:30:47Z")
Closed on July 6, 2017, 5:30am UTC