# Parsing multiple log format in same file

**URL:** https://discuss.elastic.co/t/parsing-multiple-log-format-in-same-file/179825
**Category:** Logstash
**Created:** [May 6, 2019, 5:41pm UTC](https://discuss.elastic.co/t/parsing-multiple-log-format-in-same-file/179825 "2019-05-06T17:41:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Abhilash\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhilash_b/32/40270_2.png) [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)
#### Post date: [May 6, 2019, 5:41pm UTC](https://discuss.elastic.co/t/parsing-multiple-log-format-in-same-file/179825/1 "2019-05-06T17:41:31Z")

</div>

I have a log file as in [this link](https://pastebin.com/jFcCLJr0) which is a composite log format that consists of key value pairs with '=' as the delimiter and csv type of rows with headers which are tab seperated. Still lost on how to parse these logs in logstash.

**Note: The top part of key value pairs should act as metadata for each row.**

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 6, 2019, 6:40pm UTC](https://discuss.elastic.co/t/parsing-multiple-log-format-in-same-file/179825/2 "2019-05-06T18:40:50Z")

</div>

This [thread](https://discuss.elastic.co/t/how-to-handle-metadata-in-file-headers/167544) has an example of doing that. Note that it requires "--pipeline.workers 1", so it does not scale, and using class variables can be fragile, but it does the job.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 3, 2019, 6:54pm UTC](https://discuss.elastic.co/t/parsing-multiple-log-format-in-same-file/179825/3 "2019-06-03T18:54:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
