# Split event into multiples and parse with grok separately

**URL:** https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322
**Category:** Logstash
**Created:** [February 24, 2021, 10:38am UTC](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322 "2021-02-24T10:38:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Daniel\_Jankech](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_jankech/32/77691_2.png) [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)
#### Post date: [February 24, 2021, 10:38am UTC](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322/1 "2021-02-24T10:38:17Z")

</div>

Hello, I'm back with another question. From my understanding split function is used to split lets say messages into multiple lines of code and then you use grok to parse this into a single list of variables. However what Im trying to do is divide my log file containing multiple events into single events starting with keyword1 and ending with keyword2 and parse these with grok. Is this even possible ? Should I split the field externally and send in the separate events ?

I would like to input 1 file , resulting in for example 5 events each parsed with grok and each having its own output.

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [February 25, 2021, 1:20pm UTC](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322/2 "2021-02-25T13:20:24Z")

</div>

Can you share your raw data and give an example of expected output?

---

<div class="post-metadata">

### Author: ![Daniel\_Jankech](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_jankech/32/77691_2.png) [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)
#### Post date: [February 26, 2021, 2:45pm UTC](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322/3 "2021-02-26T14:45:27Z")

</div>

Hi , I realised this would not be a correct way of doing things but thanks for the response.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 26, 2021, 2:45pm UTC](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322/4 "2021-03-26T14:45:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
