# Instead of Single log message it displays multiple messages

**URL:** <https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484>\
**Category:** Graylog Central (peer support)\
**Created:** [January 22, 2019, 4:47pm UTC](https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484 "2019-01-22T16:47:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@ajay](https://community.graylog.org/u/ajay)\
**Post date:** [January 22, 2019, 4:47pm UTC](https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484/1 "2019-01-22T16:47:47Z")

</div>

Hello Team,

In our application, every message start with “2019-01-22 16:31:39+0000” as shown below

“2019-01-22 16:31:39+0000 [index:query-api] INFO [http-nio-8080-exec-10] [tId:418a017d-ce78-4a76-b2bf-b293ebc6f79f] [rId:6a128d76-3ecc-464b-8c14-d2344d6ca565] [tt:DEMO]{aId=} com.gainsight.service.PostgresAndRedshiftQueryAPIServiceImpl:HAPOSTGRES query built: SELECT t1.accountName AS “t1\_AccountName”, t1.recipientEmailAddress AS “t1\_RecipientEmailAddress”, t1.sfdcAccountId AS “t1\_SfdcAccountId”, t1.gsid AS “t1\_Gsid”, t1.participantId AS “t1\_ParticipantId”, t1.participantState AS “t1\_ParticipantState”, t1.participantSourceName AS “t1\_ParticipantSourceName”, t1.failureReasons AS “t1\_FailureReasons”, t1.contextAttributeString1 AS “t1\_ContextAttributeString1”, t1.contextAttributeString2 AS “t1\_ContextAttributeString2”  
LIMIT 1000”

But instead of the single message, it displays as three messages in Graylog as shown in the below fig

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5507aedcd28660614c64a0bcd23d4d931491f4c9.png)

Pls help me.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [January 23, 2019, 6:23am UTC](https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484/2 "2019-01-23T06:23:43Z")

</div>

How did you ingest the messages to Graylog?

---

<div class="post-metadata">

**Author:** ![ajay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@ajay](https://community.graylog.org/u/ajay)\
**Post date:** [January 23, 2019, 8:46am UTC](https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484/3 "2019-01-23T08:46:48Z")

</div>

Hello Jan Doberstein,

**At The Client Side:**  
Install “graylog-sidecar-1.0.0-1.beta.2.x86\_64.rpm” and configured “/etc/graylog/sidecar/sidecar.yml” the server details, Node Name and API Token.

At Server side:

# Needed for Graylog

fields\_under\_root: true  
fields.collector\_node\_id: {sidecar.nodeName} fields.gl2\_source\_collector: {sidecar.nodeId}

filebeat.inputs:

- input\_type: log  
paths:
  - /data/autoqa01/query-api/logs/\*query-api.log  
type: log  
output.logstash:  
hosts: [“http://{domain}:5044”]  
path:  
data: /var/cache/graylog-sidecar/filebeat/data  
logs: /var/log/graylog-sidecar

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [January 23, 2019, 12:16pm UTC](https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484/4 "2019-01-23T12:16:28Z")

</div>

so you use sidecar and filebeat as collector to send messages.

Please read how to read and send multi line messages with filebeat: [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)

---

<div class="post-metadata">

**Author:** ![ajay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@ajay](https://community.graylog.org/u/ajay)\
**Post date:** [January 23, 2019, 5:53pm UTC](https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484/5 "2019-01-23T17:53:51Z")

</div>

Thank you Jan Doberstein, Working fine with below settings  
multiline.pattern: ‘^[0-9]{4}-[0-9]{2}-[0-9]{2}’  
multiline.negate: true  
multiline.match: after

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 6, 2019, 5:53pm UTC](https://community.graylog.org/t/instead-of-single-log-message-it-displays-multiple-messages/8484/6 "2019-02-06T17:53:52Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.