Beats apache module. Multiline to join PHP Stack trace

Filebeat version: 7.3.1
OS: Ubuntu 18.04 LTS
Filebeat module: Apache
Filebeat Output: Elastichost:9200

Problem description: Our Apache error log contains PHP Stacktraces that spans many lines.

Question 1: Is it possible to merge stacktraces with multiline settings directly in the apache.yml module?
According to documentation Manage multiline messages
these settings goes into filebeat.yml and not the specific module (apache).

I've tried with different multiline settings directly in the apache.yml and restarted the filebeat services - It starts up fine without any complaints, but each stacktrace line is still separated.

Follow up Question 2: I'm unsure that i got the correct regexp line for multiline.pattern, If someone could help me out it would be greatly appreciated. :smiling_face_with_three_hearts:

Example for Apache error log:

Blockquote
[Wed Sep 11 10:45:36.633201 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Stack trace:, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633252 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 1. {main}() /var/www/Website/webroot/TheWebSite/wp-cron.php:0, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633274 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 2. do_action_ref_array() /var/www/Website/webroot/TheWebSite/wp-cron.php:133, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633294 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 3. WP_Hook->do_action() /var/www/Website/webroot/TheWebSite/wp-includes/plugin.php:531, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633314 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 4. WP_Hook->apply_filters() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:310, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633331 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 5. wp_version_check() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:286, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633348 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 6. do_action() /var/www/Website/webroot/TheWebSite/wp-includes/update.php:240, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633367 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 7. WP_Hook->do_action() /var/www/Website/webroot/TheWebSite/wp-includes/plugin.php:465, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633385 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 8. WP_Hook->apply_filters() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:310, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633402 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 9. wp_maybe_auto_update() /var/www/Website/webroot/TheWebSite/wp-includes/class-wp-hook.php:286, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633441 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 10. WP_Automatic_Updater->run() /var/www/Website/webroot/TheWebSite/wp-includes/update.php:602, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633462 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 11. WP_Automatic_Updater->after_core_update() /var/www/Website/webroot/TheWebSite/wp-admin/includes/class-wp-automatic-updater.php:498, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.633480 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP 12. WP_Automatic_Updater->send_email() /var/www/Website/webroot/TheWebSite/wp-admin/includes/class-wp-automatic-updater.php:529, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.622885 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Warning: stream_socket_enable_crypto(): Peer certificate CN=dev04.CMP.SRV' did not match expected CN=localhost' in /var/www/Website/webroot/TheWebSite/wp-includes/class-smtp.php on line 368, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375
[Wed Sep 11 10:45:36.622885 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Warning: stream_socket_enable_crypto(): Peer certificate CN=dev04.CMP.SRV' did not match expected CN=localhost' in /var/www/Website/webroot/TheWebSite/wp-includes/class-smtp.php on line 368, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375[Wed Sep 11 10:45:36.633201 2019] [php7:notice] [pid 13832] [client 192.168.60.13:41228] PHP Stack trace:, referer: http://TheWebSite.utv03-18.CMP.SRV/wp-cron.php?doing_wp_cron=1559551511.0737988948822021484375

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.