# Single file multiple log entries

**URL:** <https://discuss.elastic.co/t/single-file-multiple-log-entries/171304>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [March 7, 2019, 12:40pm UTC](https://discuss.elastic.co/t/single-file-multiple-log-entries/171304 "2019-03-07T12:40:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![oceanvijai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oceanvijai/32/41662_2.png) [@oceanvijai](https://discuss.elastic.co/u/oceanvijai)\
**Post date:** [March 7, 2019, 12:40pm UTC](https://discuss.elastic.co/t/single-file-multiple-log-entries/171304/1 "2019-03-07T12:40:51Z")

</div>

Hi,  
Lets say I have a single log file with heterogeneous entries like this

....  
[time] methodName parameter1 parameter2 parameter3  
....  
[time] networkCall 200 4000  
.....  
[time] methodName parameter1 parameter2 parameter3  
....  
[time] networkName 200 4300  
.....

Now there are two types of logs here. One I would like to be mode as method, parameters etc  
and other I would like to name, response\_code and response\_time.

How can I convert these information into useful indexes in ES for analysis.  
How can build my filter block to achieve this.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 7, 2019, 3:48pm UTC](https://discuss.elastic.co/t/single-file-multiple-log-entries/171304/2 "2019-03-07T15:48:51Z")

</div>

I understand you may not be able to reveal proprietary data, but you are asking us to find a pattern in your data when you do not show us the data.

If the lines that contain methodName always have 3 parameters and the network lines always have two, then you can distinguish them using the number of fields. If that is not the case you are going to have to find some other pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2019, 3:48pm UTC](https://discuss.elastic.co/t/single-file-multiple-log-entries/171304/3 "2019-04-04T15:48:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.