# Weblogic access log lines being merged into a single event/message

**URL:** <https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242>\
**Category:** Beats\
**Created:** [July 14, 2017, 8:26pm UTC](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242 "2017-07-14T20:26:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![flasantos19](https://avatars.discourse-cdn.com/v4/letter/f/58956e/32.png) [@flasantos19](https://discuss.elastic.co/u/flasantos19)\
**Post date:** [July 14, 2017, 8:26pm UTC](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242/1 "2017-07-14T20:26:49Z")

</div>

Hello guys, i'm new to ELK Stack and i am having some troubles trying to parse weblogic access log files. In short, my problem is:

log sample i need to parse (2 different events):

```auto
10.153.236.90	-	2017-07-14	-	16:48:14	-	POST	-	200	-	/EBS/ListarProdutosDisponiveisResgatev1	-	1102	-	3.648
10.153.228.161	-	2017-07-14	-	16:48:16	-	POST	-	200	-	/EBS/ConsultarParticipantev1	-	7354	-	1.024

```

Filebeat prospector config:

```auto
paths:
  - /path/to/log/file.log
  document_type: access_logs
  clean_removed: true
  scan_frequency: 10s
  tags: ["wls_access_logs"]
  tail_files: true
  exclude_lines: ["^#"]

```

Logstash filter:

```auto
if "wls_access_logs" in [tags]
  {
    grok
    {
      patterns_dir => ["/path/to/patterns"]
      match => { "message" => "%{ACCESS_PATTERN}" }
      remove_field => "offset"
    }
  }

ACCESS_PATTERN:
ACCESS_PATTERN %{IPV4:IP}\t-\t%{YEAR:Year}-%{MONTHNUM:Month}-%{MONTHDAY:Day}\t-\t%{HOUR:Hour}:%{MINUTE:Minute}:%{SECOND:Second}\t-\t%{WORD:Method}\t-\t%{BASE16FLOAT:HTTP_Status}\t-\t%{URIPATHPARAM:URI}\t-\t%{BASE16NUM:Bytes}\t-\t%{BASE16FLOAT:Response_Time}

```

The filter works fine, but in Kibana i eventually see two log lines being merged into a single message, as follows in the screenshots below:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/8/8/8817a7f0dcfe4c584fb17b3d697a5614bfe069c1.png)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/7/2/72bcafd211def86a00e6b47d97ff02a5e6e4df17.png)

Any hint about what am i doing wrong?  
Thanks a lot.

---

<div class="post-metadata">

**Author:** ![flasantos19](https://avatars.discourse-cdn.com/v4/letter/f/58956e/32.png) [@flasantos19](https://discuss.elastic.co/u/flasantos19)\
**Post date:** [July 15, 2017, 4:03am UTC](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242/2 "2017-07-15T04:03:43Z")

</div>

Solved by removing the --\> tail\_files: true \<-- from the prospector config.  
Thanks.

---

<div class="post-metadata">

**Author:** ![flasantos19](https://avatars.discourse-cdn.com/v4/letter/f/58956e/32.png) [@flasantos19](https://discuss.elastic.co/u/flasantos19)\
**Post date:** [July 17, 2017, 8:39pm UTC](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242/3 "2017-07-17T20:39:13Z")

</div>

Removing the tail\_files: true didn't work. Still testing...

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 17, 2017, 11:18pm UTC](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242/4 "2017-07-17T23:18:00Z")

</div>

you don't have multiline configured. That is, filebeat will split the lines on `\n` (newline) and push those to logstash. do you have multiline configured (maybe in the beats input?)?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2017, 8:26pm UTC](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242/5 "2017-08-04T20:26:54Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.