# Read multiple log

**URL:** <https://discuss.elastic.co/t/read-multiple-log/90124>\
**Category:** Logstash\
**Created:** [June 20, 2017, 4:09pm UTC](https://discuss.elastic.co/t/read-multiple-log/90124 "2017-06-20T16:09:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [June 20, 2017, 4:09pm UTC](https://discuss.elastic.co/t/read-multiple-log/90124/1 "2017-06-20T16:09:17Z")

</div>

i want index multiple log with one input but logstash not read files

my config :

```
  input {
        file {
    		path => "C:/data1/log/*.log"
    		start_position => "beginning"
            sincedb_path => "/dev/null"
    		 type => "bctLog"
            }
    }

filter {

grok {
   match => { "message" => "%{MONTH:month} %{NUMBER:day}, %{YEAR:year} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}:%{NUMBER:milli}: %{LOGLEVEL:log-level} [%{DATA:threadName}\] took %{NUMBER:duration} ms." }
}
mutate {
    add_field => { 
        "eventTime" => "%{hour}:%{minute}:%{second} %{month} %{day} %{year}"
    }
}
mutate {
   convert => { "duration" => "integer" }
}
date {
    match => ["eventTime" , "HH:mm:ss MMM d yyyy" , "HH:mm:ss MMM dd yyyy"]
    locale => "en"
}
            
mutate {
  remove_field => ["year", "month", "day", "time","message","frmwk","host","path","hour","minute","second","milli"]
}
            
}
output {
    elasticsearch {
        index => "cfrbif-multiple"
        hosts => "localhost:9200"
    }
  stdout { codec => json }
}

```

Please help.  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 21, 2017, 9:44am UTC](https://discuss.elastic.co/t/read-multiple-log/90124/2 "2017-06-21T09:44:10Z")

</div>

On Windows use `sincedb_path => "nul"` instead of `sincedb_path => "/dev/null"`.

---

<div class="post-metadata">

**Author:** ![mohammed\_cherif](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@mohammed\_cherif](https://discuss.elastic.co/u/mohammed_cherif)\
**Post date:** [June 29, 2017, 1:31pm UTC](https://discuss.elastic.co/t/read-multiple-log/90124/3 "2017-06-29T13:31:30Z")

</div>

Thank's 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2017, 1:31pm UTC](https://discuss.elastic.co/t/read-multiple-log/90124/4 "2017-07-27T13:31:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.