# What is the best way to parse a log file which has sections that I need to remember when reading following lines?

**URL:** <https://discuss.elastic.co/t/what-is-the-best-way-to-parse-a-log-file-which-has-sections-that-i-need-to-remember-when-reading-following-lines/26897>\
**Category:** Logstash\
**Created:** [August 5, 2015, 1:57pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-parse-a-log-file-which-has-sections-that-i-need-to-remember-when-reading-following-lines/26897 "2015-08-05T13:57:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![andr\_eas](https://avatars.discourse-cdn.com/v4/letter/a/9de0a6/32.png) [@andr\_eas](https://discuss.elastic.co/u/andr_eas)\
**Post date:** [August 5, 2015, 1:57pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-parse-a-log-file-which-has-sections-that-i-need-to-remember-when-reading-following-lines/26897/1 "2015-08-05T13:57:40Z")

</div>

Hi everybody,

I'm working on project where I need to parse a log file that is optimized for human consumpion and therefore difficult to parse. It looks like follows

[NODE]-----[DESCRIPTION]-----[DATE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[NODE]-----[DESCRIPTION]-----[DATE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]  
[TIME] [PROCESS] [INFORMATION] [OTHERNODE]

[NODE] and [DATE] refer to each of the following lines of the section.

I want to visualize this in Kibana in a way, that allows to link [NODE] and [OTHERNODE]. Apart from that I obviously need to combine [DATE] and [TIME] to create a unique timestamp.

What is the best way to do this in Logstash?

Kind regards and thanks in advance,  
Andreas

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-parse-a-log-file-which-has-sections-that-i-need-to-remember-when-reading-following-lines/26897/2 "2017-07-06T05:32:49Z")

</div>