# Parse different records in 1 document

**URL:** <https://discuss.elastic.co/t/parse-different-records-in-1-document/325471>\
**Category:** Elasticsearch\
**Created:** [February 14, 2023, 12:25pm UTC](https://discuss.elastic.co/t/parse-different-records-in-1-document/325471 "2023-02-14T12:25:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bart-d-sdlr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bart-d-sdlr/32/117230_2.png) [@Bart-d-sdlr](https://discuss.elastic.co/u/Bart-d-sdlr)\
**Post date:** [February 14, 2023, 12:25pm UTC](https://discuss.elastic.co/t/parse-different-records-in-1-document/325471/1 "2023-02-14T12:25:52Z")

</div>

Hi,  
I have a (maybe stupid) question concerning parsing of custom logfile where the Date is the first record followed by the detailed lines (time,....)  
I don't use logstash, but filebeat and pipelines  
Simple example:  
Input Records:

12/02/2023  
10:15 10:15 host1 40 800  
10:20 10:20 host2 20 300  
13/02/2023  
05:30 05:30 host2 65 1200  
07:20 07:20 host3 05 3000  
...  
Output:  
documents should be like:  
"doc": {  
"\_index": "\_index",  
"\_id": "\_id",  
"\_version": "-3",  
"\_source": {  
"date": "12/02/2023",  
"time": "10:15",  
"hostname": "host1",  
"cpu": "40",  
"memory": "800"  
}  
}  
"doc": {  
"\_index": "\_index",  
"\_id": "\_id",  
"\_version": "-3",  
"\_source": {  
"date": "12/02/2023",  
"time": "10:20",  
"hostname": "host2",  
"cpu": "20",  
"memory": "300"  
}  
}  
"doc": {  
"\_index": "\_index",  
"\_id": "\_id",  
"\_version": "-3",  
"\_source": {  
"date": "13/02/2023"  
"time": "05:30",  
"hostname": "host2",  
"cpu": "65",  
"memory": "1200"  
}  
}

etc...So the date must be in every record  
Anyone has any idea how to do this ?  
Tnx !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2023, 12:26pm UTC](https://discuss.elastic.co/t/parse-different-records-in-1-document/325471/2 "2023-03-14T12:26:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.