# Send data in seperate lines from beats **URL:** \ **Category:** Beats\ **Created:** [December 2, 2019, 11:16am UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169 "2019-12-02T11:16:45Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Post date:** [December 2, 2019, 11:16am UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169/1 "2019-12-02T11:16:45Z")
Hi , We are configuring Siebel app server monitoring and we are running a batch file in execbeat . our output looks like below . * * * Siebel Enterprise Applications Siebel Server Manager, Version 16.19.0.0 [23057] LANG\_INDEPENDENT Copyright (c) 2008,2016, Oracle. All rights reserved. The Programs (which include both the software and documentation) contain proprietary information; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited. Oracle, JD Edwards, PeopleSoft, and Siebel are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. If you have received this software in error, please notify Oracle Corporation immediately at 1.800.ORACLE1. Type "help" for list of commands, "help " for detailed help Connected to 13 server(s) out of a total of 13 server(s) in the enterprise srvrmgr\> list comp show SV\_NAME,CC\_ALIAS,CP\_DISP\_RUN\_STATE,CP\_STARTMODE,CP\_NUM\_RUN\_TASKS,CP\_MAX\_TASKS,CC\_NAME order by CP\_DISP\_RUN\_STATE SV\_NAME CC\_ALIAS CP\_DISP\_RUN\_STATE CP\_STARTMODE CP\_NUM\_RUN\_TASKS CP\_MAX\_TASKS CC\_NAME * * * D1220001027A FSMSrvr Online Auto 0 20 File System Manager D1220001027A ServerMgr Running Auto 4 20 Server Manager D1220001027A SRBroker Running Auto 29 100 Server Request Broker D1220001027A SRProc Running Auto 2 20 Server Request Processor D1220001027A SvrTaskPersist Running Auto 1 1 Server Task Persistance D1220001027A SCBroker Running Auto 2 2 Siebel Connection Broker D1220001027A SvrTblCleanup Shutdown Manual 0 1 Server Tables Cleanup D1220001030A CACWfProcMgrPE Online Auto 0 20 CAC Workflow Process Manager Process Engine D1220001030A FSMSrvr Online Auto 0 20 File System Manager D1220001030A SFMWfProcMgrPE Online Auto 0 20 SFM Workflow Process Manager Process Engine D1220001030A ServerMgr Running Auto 4 20 Server Manager * * * I am sending this whole data to Logstash to parse from Execbeat and trying to filter same using Grok , I want only the info data which sample looks like below , and no other info D1220001030A ServerMgr Running Auto 4 20 Server Manager It should be stored in separate each line , but the whole file to logstash coming as a single line . My Grok filter which is matching above line is : filter { grok { match =\> {"message" =\> "%{WORD:ServerName}%{SPACE}%{WORD:Comp\_Alias}%{SPACE}%{WORD:CompStatus}%{SPACE}%{WORD:CompStartMode}%{SPACE}%{WORD:RunningTasks}%{SPACE}%{WORD:MaxTasks}%{GREEDYDATA:CompName}"} } } So , If i see in Kibana , i see whole thing , where as i want beats to send as seperate lines to Logstash so that Logstash will consider each line . Any way can we send the output of my command as seperate lines to logstash ? .Please help . Thanks in Advance Saravana S ---
**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Post date:** [December 4, 2019, 8:35am UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169/2 "2019-12-04T08:35:20Z")
Any reply here please ? ---
**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Post date:** [December 16, 2019, 7:13am UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169/3 "2019-12-16T07:13:42Z")
Any suggestions please ? ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [December 16, 2019, 12:41pm UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169/4 "2019-12-16T12:41:14Z")
Hey @Saravana37, I don't know about execbeat, but Filebeat sends one line per event by default, would it be possible to use it in your use case? ---
**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Post date:** [December 17, 2019, 4:12am UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169/5 "2019-12-17T04:12:21Z")
Thanks @jsoriano for the reply . My requirement is to execute a command in the commandline and send the output to Logstash for parshing . I believe filebeat is for shipping the logs ? ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [December 17, 2019, 12:30pm UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169/6 "2019-12-17T12:30:41Z")
Yes, filebeat collects logs from files and other inputs. You would still need something to execute the command and write the output to a file. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 28, 2020, 4:49am UTC](https://discuss.elastic.co/t/send-data-in-seperate-lines-from-beats/210169/8 "2020-01-28T04:49:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.