# To Read particular event form text file

**URL:** <https://discuss.elastic.co/t/to-read-particular-event-form-text-file/227861>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 14, 2020, 7:25am UTC](https://discuss.elastic.co/t/to-read-particular-event-form-text-file/227861 "2020-04-14T07:25:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aman97](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@aman97](https://discuss.elastic.co/u/aman97)\
**Post date:** [April 14, 2020, 7:25am UTC](https://discuss.elastic.co/t/to-read-particular-event-form-text-file/227861/1 "2020-04-14T07:25:50Z")

</div>

Hi,

I am having a multiline text file with multiple events, I want to read a particular event from a file.  
First, I want to know how can I read this particular multiline text file in filebeat  
then after how can i extract particular event from file

---

<div class="post-metadata">

**Author:** ![aman97](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@aman97](https://discuss.elastic.co/u/aman97)\
**Post date:** [April 14, 2020, 7:27am UTC](https://discuss.elastic.co/t/to-read-particular-event-form-text-file/227861/2 "2020-04-14T07:27:12Z")

</div>

# MachineName: DEVELOPER-PC UserDomainName: Developer-PC UserName: Developer OSVersion: Microsoft Windows NT 6.1.7601 Service Pack 1 UserInteractive: True CLR Version: 4.0.30319.42000

# Command Line: "R:\Bin\NCR.APTRA.UATestServer.exe" Configuration Path: R:\Bin\Config\NCR.APTRA.UATestServer.accfg Current Directory: R:\Bin CodeBase Directory: R:\Bin

# ApplicationData: C:\Users\Developer\AppData\Roaming CommonApplicationData: C:\ProgramData CommonProgramFiles: C:\Program Files\Common Files LocalApplicationData: C:\Users\Developer\AppData\Local ProgramFiles: C:\Program Files

# Host Name: Developer-PC IPAddress(es): fe80::c11c:4c40:1d2:8ad4%11 10.0.2.15

# Time Zone Information Short DateTime Pattern: M/d/yyyy h:mm tt DateTime.Kind: Local Standard time name: India Standard Time Daylight saving time name: India Daylight Time Current date and time: 11/18/2019 4:44:03 PM Daylight saving time? False Coordinated Universal Time: 11/18/2019 11:14:03 AM UTC offset: 05:30:00 Daylight saving time for year 2019: 1/1/0001 12:00:00 AM to 1/1/0001 12:00:00 AM, delta: 00:00:00

Creating test data...  
ServerManagement WebService  
[Address] = 127.0.0.1, [Port] = 8080, [RelativeURI] = project24/services/ManagementService, [Compression] = None, [SecurityMode] = None, [CertIssuer] = , [CertSubject] = , [CertSerialNumber] = , [MaxArrayLength] = 2147483647, [MaxBytesPerRead] = 4096, [MaxDepth] = 2147483647, [MaxNameTableCharCount] = 2147483647, [MaxStringContentLength] = 2147483647, [MaxBufferPoolSize] = 524288, [MaxBufferSize] = 524288, [MaxReceivedMessageSize] = 524288, [OpenTimeout] = 180, [CloseTimeout] = 180, [SendTimeout] = 180, [ReceiveTimeout] = 600, [MutualAuthentication] = False, [CertificateHash] =

ClientManagement WebService  
[Address] = 127.0.0.1, [Port] = 9090, [RelativeURI] = project24/aptra/unifiedagent/clientmgmt/server, [Compression] = None, [SecurityMode] = None, [CertIssuer] = , [CertSubject] = , [CertSerialNumber] = , [MaxArrayLength] = 2147483647, [MaxBytesPerRead] = 4096, [MaxDepth] = 2147483647, [MaxNameTableCharCount] = 2147483647, [MaxStringContentLength] = 2147483647, [MaxBufferPoolSize] = 524288, [MaxBufferSize] = 524288, [MaxReceivedMessageSize] = 524288, [OpenTimeout] = 180, [CloseTimeout] = 180, [SendTimeout] = 180, [ReceiveTimeout] = 600, [MutualAuthentication] = False, [CertificateHash] =

# ================================================================================ 11/18/2019 4:44:03 PM Test Server hosted URI: [http://127.0.0.1:8080/project24/services/ManagementService](http://127.0.0.1:8080/project24/services/ManagementService)

serverMgmtHost\_Opening  
serverMgmtHost\_Opened  
---------- Construct Client ----------  
[Address] = 127.0.0.1, [Port] = 9090, [RelativeURI] = project24/aptra/unifiedagent/clientmgmt/server, [Compression] = None, [SecurityMode] = None, [CertIssuer] = , [CertSubject] = , [CertSerialNumber] = , [MaxArrayLength] = 2147483647, [MaxBytesPerRead] = 4096, [MaxDepth] = 2147483647, [MaxNameTableCharCount] = 2147483647, [MaxStringContentLength] = 2147483647, [MaxBufferPoolSize] = 524288, [MaxBufferSize] = 524288, [MaxReceivedMessageSize] = 524288, [OpenTimeout] = 180, [CloseTimeout] = 180, [SendTimeout] = 180, [ReceiveTimeout] = 600, [MutualAuthentication] = False, [CertificateHash] =

# ================================================================================ 11/18/2019 4:45:12 PM Received Message from 127.0.0.1: Register terminal = TerminalInfo Address = 127.0.0.1 UniqueId = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6 CustomerCode = Undefined Properties = [0] [TerminalId] = Developer-PC-0 [1] [MACAddress] = 00:00:00:00:00:00 [2] [MachineName] = Developer-PC [3] [UAVersion] = 04.06.00.01 [4] [GUID] = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6 [5] [IPAddress] = 127.0.0.1 [6] [CustomerCode] = Undefined [7] [ConfigurationHashUAWSLoaded] = [0] = 119 [1] = 203 [2] = 91 [3] = 196 [4] = 166 [5] = 186 [6] = 222 [7] = 93 [8] = 108 [9] = 81 [10] = 170 [11] = 147 [12] = 118 [13] = 62 [14] = 235 [15] = 114 [8] [ConfigurationHashUAWSStaged] = [0] = 119 [1] = 203 [2] = 91 [3] = 196 [4] = 166 [5] = 186 [6] = 222 [7] = 93 [8] = 108 [9] = 81 [10] = 170 [11] = 147 [12] = 118 [13] = 62 [14] = 235 [15] = 114 [9] [ConfigurationHashSWD1] = [10] [ConfigurationHashSWD2] = [11] [CultureInfo.LCID] = 1033 [12] [CultureInfo.Name] = en-US [13] [XFSVendorName] = [14] [ServerCommsMode] = Active CollectorInfo = state = [0] [SubscribedEventOccurred.SequenceNumber] = 0 [1] [TerminalInfo.TerminalId] = Developer-PC-0 [2] [TerminalInfo.MACAddress] = 00:00:00:00:00:00 [3] [TerminalInfo.MachineName] = Developer-PC Exception: Value cannot be null. Parameter name: stream Could not load file: NCR.APTRA.UATestServer.SNMPManagementCollector.xml

11/18/2019 4:46:49 PM Received Message from 127.0.0.1: SubscribedEventOccurred  
sequenceNum = 52  
terminal = TerminalInfo  
Address = 127.0.0.1  
UniqueId = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6  
CustomerCode = Undefined  
Properties =  
[0] [TerminalId] = Developer-PC-0  
[1] [MACAddress] = 00:00:00:00:00:00  
[2] [MachineName] = Developer-PC  
[3] [UAVersion] = 04.06.00.01  
[4] [GUID] = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6  
[5] [IPAddress] = 127.0.0.1  
[6] [CustomerCode] = Undefined  
CollectorInfo =  
[0] [Version] = 1.0.0.3  
eventName = NCR.APTRA.Reboot.Complete  
eventDetails =  
[0] = ManagementEventInfo  
ClassUri = NCR.APTRA.Reboot.Complete  
Properties =  
[0] [WindowsRebootEventID] = 1074  
[1] [WindowsRebootReason] = Recovery Reboot due to CX AGENT ISSUE  
Reason Code: 0x80020003  
Shutdown Type: restart  
Comment:  
[2] [WindowsRebootUTCEventTimestamp] = 12/10/2019 3:00:00 AM  
[3] [TriggerEventUri] = NCR.APTRA.IMgmtServerComms.UANullptr  
[4] [TriggerEventSequenceNumber] = 0  
[5] [TriggerUTCTimestamp] = NCR.APTRA.IMgmtServerComms.UANullptr  
[6] [UTCTimeStamp] = 12/10/2019 6:03:56 AM  
classDetails =  
  
documentFragment = Document  
Uri =  
InstanceName =  
Command = RebuildAndRetrieve (0)  
Data =

================================================================================  
11/18/2019 4:48:09 PM Received Message from 127.0.0.1: DocumentUpload  
terminal = TerminalInfo  
Address = 127.0.0.1  
UniqueId = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6  
CustomerCode = Undefined  
Properties =  
[0] [TerminalId] = Developer-PC-0  
[1] [MACAddress] = 00:00:00:00:00:00  
[2] [MachineName] = Developer-PC  
[3] [UAVersion] = 04.06.00.01  
[4] [GUID] = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6  
[5] [IPAddress] = 127.0.0.1  
[6] [CustomerCode] = Undefined  
CollectorInfo =  
[0] [Version] = 2.17.0.1  
result = RequestResult  
Status = Success  
requestId = 0  
classUri = NCR.APTRA.InventoryCollector.AggregateInventory  
instanceName = Default  
documentFragment = Document  
Uri = NCR.APTRA.InventoryCollector.AggregateInventory  
InstanceName = Default  
Command = RetrieveDelta (2)  
Data = \<?xml version="1.0" encoding="utf-8"?\>\<Removed /

================================================================================  
11/18/2019 4:46:49 PM Received Message from 127.0.0.1: SubscribedEventOccurred  
sequenceNum = 52  
terminal = TerminalInfo  
Address = 127.0.0.1  
UniqueId = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6  
CustomerCode = Undefined  
Properties =  
[0] [TerminalId] = Developer-PC-0  
[1] [MACAddress] = 00:00:00:00:00:00  
[2] [MachineName] = Developer-PC  
[3] [UAVersion] = 04.06.00.01  
[4] [GUID] = 4260ad98-0ecc-46e8-a286-e7b7eb9050a6  
[5] [IPAddress] = 127.0.0.1  
[6] [CustomerCode] = Undefined  
CollectorInfo =  
[0] [Version] = 1.0.0.3  
eventName = NCR.APTRA.Reboot.Complete  
eventDetails =  
[0] = ManagementEventInfo  
ClassUri = NCR.APTRA.Reboot.Complete  
Properties =  
[0] [WindowsRebootEventID] = 1074  
[1] [WindowsRebootReason] = Recovery Reboot due to CX AGENT ISSUE  
Reason Code: 0x80020003  
Shutdown Type: restart  
Comment:  
[2] [WindowsRebootUTCEventTimestamp] = 14/10/2019 5:30:00 AM  
[3] [TriggerEventUri] = NCR.APTRA.IMgmtServerComms.UANullptr  
[4] [TriggerEventSequenceNumber] = 0  
[5] [TriggerUTCTimestamp] = NCR.APTRA.IMgmtServerComms.UANullptr  
[6] [UTCTimeStamp] = 14/10/2019 6:03:56 AM  
classDetails =  
  
documentFragment = Document  
Uri =  
InstanceName =  
Command = RebuildAndRetrieve (0)  
Data =

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [April 14, 2020, 9:10am UTC](https://discuss.elastic.co/t/to-read-particular-event-form-text-file/227861/3 "2020-04-14T09:10:37Z")

</div>

You will need an ingest pipeline to process the log files. In the ingest pipeline you can define all potential fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2020, 9:10am UTC](https://discuss.elastic.co/t/to-read-particular-event-form-text-file/227861/4 "2020-05-12T09:10:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.