# Need to parse alert logs

**URL:** https://discuss.elastic.co/t/need-to-parse-alert-logs/83581
**Category:** Beats
**Tags:** filebeat
**Created:** [April 25, 2017, 2:15pm UTC](https://discuss.elastic.co/t/need-to-parse-alert-logs/83581 "2017-04-25T14:15:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Debashis\_Adak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debashis_adak/32/46087_2.png) [@Debashis\_Adak](https://discuss.elastic.co/u/Debashis_Adak)
#### Post date: [April 25, 2017, 2:15pm UTC](https://discuss.elastic.co/t/need-to-parse-alert-logs/83581/1 "2017-04-25T14:15:58Z")

</div>

Hi All,

I am new in ELK. I am trying to parse the below log file:

**Logfile Body:**

Tue Oct 18 18:04:01 2016  
MMNL started with pid=20, OS id=5484  
Tue Oct 18 18:04:01 2016  
starting up 1 dispatcher(s) for network address '(ADDRESS=(PARTIAL=YES)(PROTOCOL=TCP))'...  
starting up 1 shared server(s) ...  
ORACLE\_BASE from environment = C:\app\dadak  
Tue Oct 18 18:04:02 2016  
ALTER DATABASE MOUNT  
Tue Oct 18 18:04:08 2016  
Using default pga\_aggregate\_limit of 2048 MB

What I am trying to do is to split the kibana messages from one Timestamp to another.

**Expected Result will be:**

Message 1:  
Tue Oct 18 18:04:01 2016  
MMNL started with pid=20, OS id=5484

Message 2:  
Tue Oct 18 18:04:01 2016  
starting up 1 dispatcher(s) for network address '(ADDRESS=(PARTIAL=YES)(PROTOCOL=TCP))'...  
starting up 1 shared server(s) ...  
ORACLE\_BASE from environment = C:\app\dadak

Message 3:  
Tue Oct 18 18:04:02 2016  
ALTER DATABASE MOUNT

Message 4:  
Tue Oct 18 18:04:08 2016  
Using default pga\_aggregate\_limit of 2048 MB

Can you let me know what kind of multiline pattern I should use??

Thanks in advanced...

Debashis

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 26, 2017, 10:31am UTC](https://discuss.elastic.co/t/need-to-parse-alert-logs/83581/2 "2017-04-26T10:31:03Z")

</div>

your logs always start with a timestamp. A Regex like `'^.{3} .{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}'` should match the timestamp. Checkout [the multiline docs](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) showing you example how you can configure and test multiline.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 24, 2017, 10:34am UTC](https://discuss.elastic.co/t/need-to-parse-alert-logs/83581/3 "2017-05-24T10:34:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.