# Shipping whole file as message?

**URL:** https://discuss.elastic.co/t/shipping-whole-file-as-message/94609
**Category:** Beats
**Tags:** filebeat
**Created:** [July 26, 2017, 9:57am UTC](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609 "2017-07-26T09:57:49Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![MarcusCaepio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcuscaepio/32/32458_2.png) [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)
#### Post date: [July 26, 2017, 9:57am UTC](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609/1 "2017-07-26T09:57:49Z")

</div>

Hello everyone,

I am kindly new to ELK and now I want to ship the content of a whole file as message into logstash and elastic.  
So as I have different files, each file should be a single event with all its content as message. I know that I have to use multiline in the filebeat prospector. But I don't know how to set multiline.pattern, mutliline.negate, multiline.match. The message should be in the correct order, meaning first line of the file should be also first line in the message. Can somebody please give me a hint?

Thanks in advance!

---

<div class="post-metadata">

### Author: ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)
#### Post date: [July 27, 2017, 6:18am UTC](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609/2 "2017-07-27T06:18:43Z")

</div>

Try using the file input plugin in logstash [file input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html)

---

<div class="post-metadata">

### Author: ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)
#### Post date: [July 27, 2017, 3:03pm UTC](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609/3 "2017-07-27T15:03:08Z")

</div>

You can do it with filebeat and multiline if you can easily identify the last line of you file.

Try to configure the multiline pattern to detect the last line.

You can test the pattern and negate behavior with the Go Playground described here: [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#\_testing\_your\_regexp\_pattern\_for\_multiline](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html#_testing_your_regexp_pattern_for_multiline)

---

<div class="post-metadata">

### Author: ![MarcusCaepio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcuscaepio/32/32458_2.png) [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)
#### Post date: [July 28, 2017, 4:26am UTC](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609/4 "2017-07-28T04:26:33Z")

</div>

I guess I have a solution.  
I don't have to detect the last line. Seems for me, that filebeat detects it itself. Only have to be sure to start at first line and put everything on it.  
filebeat.yml

```
filebeat.prospectors: 
- input_type: log
      paths:
        - /X/Y/*/*
      multiline.pattern: ' \A.*'
      multiline.negate: true
      multiline.match: after
      tags: ["my-tag"]
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 25, 2017, 4:26am UTC](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609/5 "2017-08-25T04:26:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.