# Newbie- trying to get info from various lines of a log

**URL:** <https://discuss.elastic.co/t/newbie-trying-to-get-info-from-various-lines-of-a-log/76083>\
**Category:** Kibana\
**Created:** [February 22, 2017, 4:49pm UTC](https://discuss.elastic.co/t/newbie-trying-to-get-info-from-various-lines-of-a-log/76083 "2017-02-22T16:49:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhooper](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@mhooper](https://discuss.elastic.co/u/mhooper)\
**Post date:** [February 22, 2017, 4:49pm UTC](https://discuss.elastic.co/t/newbie-trying-to-get-info-from-various-lines-of-a-log/76083/1 "2017-02-22T16:49:41Z")

</div>

What is best practice to get information that may be strewn over multiple lines of a log file.

Desired result: visualization of how many times 'person' bought a 'coffee' over a period of time.

I have to parse through a log which tracks events, but there is a separate log line for the person who event pertains to. The threadid for the whole transaction is the same to link them, but lines are separated.

example log lines.

timestamp threadid "Person logged in"  
timestamp threadid "Coffee purchased"

the threadids are the same, but timestamps are different. looking for a way to link these events in a manner that can be used in a visualization.

thank you

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [February 22, 2017, 7:47pm UTC](https://discuss.elastic.co/t/newbie-trying-to-get-info-from-various-lines-of-a-log/76083/2 "2017-02-22T19:47:37Z")

</div>

I would recommend you look into this excellent training by Mark Harwood about this subject: [https://www.elastic.co/elasticon/2015/sf/building-entity-centric-indexes](https://www.elastic.co/elasticon/2015/sf/building-entity-centric-indexes)

It describes the best practices surrounding what you are trying to do. Hope that helps, and please feel free to ask for clarification on anything specific.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2017, 7:47pm UTC](https://discuss.elastic.co/t/newbie-trying-to-get-info-from-various-lines-of-a-log/76083/3 "2017-03-22T19:47:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.