# Parsing multiple file and adding service-name

**URL:** <https://discuss.elastic.co/t/parsing-multiple-file-and-adding-service-name/122135>\
**Category:** Logstash\
**Created:** [March 1, 2018, 5:33pm UTC](https://discuss.elastic.co/t/parsing-multiple-file-and-adding-service-name/122135 "2018-03-01T17:33:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pjh](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@pjh](https://discuss.elastic.co/u/pjh)\
**Post date:** [March 1, 2018, 5:33pm UTC](https://discuss.elastic.co/t/parsing-multiple-file-and-adding-service-name/122135/1 "2018-03-01T17:33:37Z")

</div>

hey!

I am currently using logstash-6.0.0. I have a microservices architecture where I store all my logs in **/var/log/mservice/** and ops infrastrucutre (kibana, elasticsearch, logstash, grafana, etc) in **/var/log/ops/**

I have the following script which is not picking up anything anymore

```
##################################
# 1) INPUTS
##################################

input {
 
  # Microservice Logs
  file {
    type => "json"
    tags => ["json"]
    path => [
      "/var/log/mservices/*.log",
      "/var/log/mservices/**/*.log"
    ]
  }

  # Elasticsearch Logs
  file {
    type => "json"
    tags => ["elasticsearch"]
    start_position => "beginning"
    path => [
      "/var/log/ops/elasticsearch/*.log"
    ]
  }
  
  # Logstash Logs
  file {
    type => "json"
    tags => ["logstash"]
    start_position => "beginning"
    path => [
      "/var/log/ops/logstash/*.log"
    ]
  }
}

##################################
# 2) FILTERS
##################################

filter {

  # Microservice filters
  if "json" in [tags] {

    json {
      source => "message"
    }

    mutate {
      uppercase => ["level"] 
    }
  }

  # Elasticsearch Filters
  if "elasticsearch" in [tags] {
    
    mutate {
      add_field => { "service-name" => "elasticsearch" }
    }
  }

  # logstash Filters
  if "logstash" in [tags] {
    
    mutate {
      add_field => { "service-name" => "logstash" }
    }
  }
}

##################################
# 3) OUTPUTS
##################################

output {

  elasticsearch {
    hosts => "address"
  }
}

```

I tried to filter by type, but then I started getting the complaint:

Rejecting mapping update to [json, elasticsearch] as the final mapping would have more than 1 type multiple types. I therefore tried to filter on tags but this doesn't work 😢  
Due to reasons outside of the scope of this post, I can't use beats either.

How can I achieve what I trying to achieve?

---

<div class="post-metadata">

**Author:** ![pjh](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@pjh](https://discuss.elastic.co/u/pjh)\
**Post date:** [March 1, 2018, 10:21pm UTC](https://discuss.elastic.co/t/parsing-multiple-file-and-adding-service-name/122135/2 "2018-03-01T22:21:28Z")

</div>

I found my answer 🎉  
I posted an update on SO: [https://stackoverflow.com/questions/49058258/logstash-parsing-multiple-files-multiple-file-type-error/49059459#49059459](https://stackoverflow.com/questions/49058258/logstash-parsing-multiple-files-multiple-file-type-error/49059459#49059459)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2018, 10:21pm UTC](https://discuss.elastic.co/t/parsing-multiple-file-and-adding-service-name/122135/3 "2018-03-29T22:21:48Z")

</div>

Closed on March 29, 2018, 10:21pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.