# Sometimes entry is not recognized as a separate entry

**URL:** <https://discuss.elastic.co/t/sometimes-entry-is-not-recognized-as-a-separate-entry/128459>\
**Category:** Logstash\
**Created:** [April 18, 2018, 5:14am UTC](https://discuss.elastic.co/t/sometimes-entry-is-not-recognized-as-a-separate-entry/128459 "2018-04-18T05:14:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![prateek\_shrivastava](https://avatars.discourse-cdn.com/v4/letter/p/82dd89/32.png) [@prateek\_shrivastava](https://discuss.elastic.co/u/prateek_shrivastava)\
**Post date:** [April 18, 2018, 5:14am UTC](https://discuss.elastic.co/t/sometimes-entry-is-not-recognized-as-a-separate-entry/128459/1 "2018-04-18T05:14:44Z")

</div>

I am using C# application and logging through nlog. It is writing in file as well as sending the logs through tcp to logstash.

Actual log file is (which is written by nlog in file):

```auto
2018-04-18 10:26:51 | [38] | ERROR | BankerbayPL.UserControl.BBNewsfeedControl.getNewsFeed(BBNewsfeedControl.ascx.cs:259) | Exception When Fetching Newsfeed url: http://localhost:8080/WebServices/GetNewsFeed data passed: ?newsId=000000&max=2 Exception details : System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 127.0.0.1:8080
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
   --- End of inner exception stack trace ---
   at System.Net.HttpWebRequest.GetResponse()
   at BankerbayBL.RestClient.MakeRequest(String parameters) in E:\.Net v4 Chinese\trunk\BankerbayBL\RestClient.cs:line 101 :   
2018-04-18 10:26:53 | [31] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2970) | Unhandled exception : System.Web.HttpException (0x80004005): File does not exist.
   at System.Web.StaticFileHandler.GetFileInfo(String virtualPathWithPathInfo, String physicalPath, HttpResponse response)
   at System.Web.StaticFileHandler.ProcessRequestInternal(HttpContext context, String overrideVirtualPath)
   at System.Web.DefaultHttpHandler.BeginProcessRequest(HttpContext context, AsyncCallback callback, Object state)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)  
2018-04-18 10:26:53 | [31] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2976) | Unhandled Exception on RequestURL:/images/userProfilePic/Thumb_15_3279_15_09_2017.png  
2018-04-18 10:26:53 | [31] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2978) | Exception on UrlReferrer:http://localhost:3442/dashboard/  
2018-04-18 10:26:53 | [30] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2976) | Unhandled Exception on RequestURL:/images/userProfilePic/Thumb_4_2735_10_04_2018.png  
2018-04-18 10:26:53 | [30] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2978) | Exception on UrlReferrer:http://localhost:3442/dashboard/  
2018-04-18 10:26:54 | [32] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2976) | Unhandled Exception on RequestURL:/images/userProfilePic/Thumb_15_3279_15_09_2017.png  

```

My logstash config file is:

```auto
input { 
	tcp {
		host => "127.0.0.1"
		port => 3443
		mode => "server"
		codec => multiline {
		pattern => "^%{TIMESTAMP_ISO8601}"
		what => "previous"
		negate => true
		}
	}
} 

filter {
	grok {
      match => ["message", "^%{TIMESTAMP_ISO8601:logtime}%{SPACE}\|%{SPACE}\[%{NUMBER:thread_id}\]%{SPACE}\|%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\|%{SPACE}%{GREEDYDATA:classname}%{SPACE}\|%{SPACE}%{GREEDYDATA:logmessage}"]
   }

    date {
        match => ["logtime", "yyyy-MM-dd HH:mm:ss"]
        timezone => "GMT"
   } 
}

output { 
	file {
	   path => "C:/ServiceLogs/stashed.log"
	   codec => line { format => "custom format: %{logtime} %{thread_id} %{loglevel} %{classname} %{logmessage}"}
	}
}

```

My output in log file is:

```auto
custom format: 2018-04-18 10:26:51 38 ERROR BankerbayPL.UserControl.BBNewsfeedControl.getNewsFeed(BBNewsfeedControl.ascx.cs:259) Exception When Fetching Newsfeed url: http://localhost:8080/WebServices/GetNewsFeed data passed: ?newsId=000000&max=2 Exception details : System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 127.0.0.1:8080

   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)

   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)

   --- End of inner exception stack trace ---

   at System.Net.HttpWebRequest.GetResponse()

   at BankerbayBL.RestClient.MakeRequest(String parameters) in E:\.Net v4 Chinese\trunk\BankerbayBL\RestClient.cs:line 101 :   
custom format: 2018-04-18 10:26:53 31 ERROR BankerbayPL.Global.Application_Error(Global.asax.cs:2976) | Unhandled Exception on RequestURL:/images/userProfilePic/Thumb_15_3279_15_09_2017.png 2018-04-18 10:26:53 | [31] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2978) | Exception on UrlReferrer:http://localhost:3442/dashboard/ 2018-04-18 10:26:53 | [30] | ERROR | BankerbayPL.Global.Application_Error(Global.asax.cs:2970) Unhandled exception : System.Web.HttpException (0x80004005): File does not exist.

   at System.Web.StaticFileHandler.GetFileInfo(String virtualPathWithPathInfo, String physicalPath, HttpResponse response)

   at System.Web.StaticFileHandler.ProcessRequestInternal(HttpContext context, String overrideVirtualPath)

   at System.Web.DefaultHttpHandler.BeginProcessRequest(HttpContext context, AsyncCallback callback, Object state)

   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)  
custom format: 2018-04-18 10:26:53 31 ERROR BankerbayPL.Global.Application_Error(Global.asax.cs:2970) Unhandled exception : System.Web.HttpException (0x80004005): File does not exist.

   at System.Web.StaticFileHandler.GetFileInfo(String virtualPathWithPathInfo, String physicalPath, HttpResponse response)

   at System.Web.StaticFileHandler.ProcessRequestInternal(HttpContext context, String overrideVirtualPath)

   at System.Web.DefaultHttpHandler.BeginProcessRequest(HttpContext context, AsyncCallback callback, Object state)

   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)  
custom format: 2018-04-18 10:26:53 30 ERROR BankerbayPL.Global.Application_Error(Global.asax.cs:2976) Unhandled Exception on RequestURL:/images/userProfilePic/Thumb_4_2735_10_04_2018.png  
custom format: 2018-04-18 10:26:54 32 ERROR BankerbayPL.Global.Application_Error(Global.asax.cs:2976) Unhandled Exception on RequestURL:/images/userProfilePic/Thumb_15_3279_15_09_2017.png  

```

I don't the logs to be combined. Every line should be a different entry. How can I do that?

---

<div class="post-metadata">

**Author:** ![prateek\_shrivastava](https://avatars.discourse-cdn.com/v4/letter/p/82dd89/32.png) [@prateek\_shrivastava](https://discuss.elastic.co/u/prateek_shrivastava)\
**Post date:** [April 18, 2018, 11:14am UTC](https://discuss.elastic.co/t/sometimes-entry-is-not-recognized-as-a-separate-entry/128459/2 "2018-04-18T11:14:41Z")

</div>

Got this sorted.  
Thank you !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2018, 11:14am UTC](https://discuss.elastic.co/t/sometimes-entry-is-not-recognized-as-a-separate-entry/128459/3 "2018-05-16T11:14:57Z")

</div>

Closed on May 16, 2018, 11:14am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.