# Parse log file line by line

**URL:** <https://discuss.elastic.co/t/parse-log-file-line-by-line/329518>\
**Category:** Logstash\
**Created:** [April 6, 2023, 1:18pm UTC](https://discuss.elastic.co/t/parse-log-file-line-by-line/329518 "2023-04-06T13:18:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pen120](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pen120/32/119502_2.png) [@pen120](https://discuss.elastic.co/u/pen120)\
**Post date:** [April 6, 2023, 1:18pm UTC](https://discuss.elastic.co/t/parse-log-file-line-by-line/329518/1 "2023-04-06T13:18:34Z")

</div>

I have a log file with output repetitive below, I want to parse this log line by line in fields to extract the value for each line

```auto
10:31:07 2022/10/16 ZBXTRAP 192.168.23.2
PDU INFO:
  messageid 0
  community public
  errorindex 0
  transactionid 2
  errorstatus 0
  version 1
  notificationtype TRAP
  requestid 646956120
  receivedfrom UDP: [192.168.23.2]:32768->[192.168.23.99]:162
VARBINDS:
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (3644796808) 421 days, 20:26:08.08
  SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.6302 .2.1.5.1
  SNMPv2-SMI::enterprises.6302.2.1.4.1.1 type=65 value=Counter32: 1280
  SNMPv2-SMI::enterprises.6302.2.1.4.1.2 type=4 value=Hex-STRING: 07 DE 08 07 0 6 16 07 00 2B 00 00
  SNMPv2-SMI::enterprises.6302.2.1.4.1.3 type=2 value=INTEGER: 2
  SNMPv2-SMI::enterprises.6302.2.1.4.1.4 type=2 value=INTEGER: 3
  SNMPv2-SMI::enterprises.6302.2.1.4.1.5 type=4 value=STRING: "Mains Failure, its owner: Power System"
  SNMPv2-SMI::enterprises.6302.2.1.4.1.6 type=2 value=INTEGER: 78325

```

my logstash script that give a message field:

```auto
input {
  file {
    path => "/var/log/snmptrap/snmptrap.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => multiline{
      pattern =>"%{DATE:date} %{TIME:time}"
      negate =>true
      what => "previous"
    }
  }
}
output {
        elasticsearch {
        hosts => ["127.0.0.1:9200"]
        }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 6, 2023, 1:20pm UTC](https://discuss.elastic.co/t/parse-log-file-line-by-line/329518/2 "2023-04-06T13:20:58Z")

</div>

> [@pen120](#):
>
> I want to parse this log line by line in fields to extract the value for each line

If you want to parse it line by line you need to remove the `multiline` codec from your input.

This will make every line in the log you shared independent from each other.

---

<div class="post-metadata">

**Author:** ![pen120](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pen120/32/119502_2.png) [@pen120](https://discuss.elastic.co/u/pen120)\
**Post date:** [April 6, 2023, 1:37pm UTC](https://discuss.elastic.co/t/parse-log-file-line-by-line/329518/3 "2023-04-06T13:37:49Z")

</div>

I have a repetitive bloc with the same format of lines, how to have a entry in Kibana of each bloc if I suppress multiline codec?  
i have used multiline codec to parse to message field in logstash,  
how to parse message field

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 6, 2023, 1:58pm UTC](https://discuss.elastic.co/t/parse-log-file-line-by-line/329518/4 "2023-04-06T13:58:53Z")

</div>

You could use grok. See [this thread](https://discuss.elastic.co/t/help-with-using-grok-to-parse-these-three-log-formats/329107/2) for an example.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2023, 1:59pm UTC](https://discuss.elastic.co/t/parse-log-file-line-by-line/329518/5 "2023-05-04T13:59:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.