Hi,
I have been trying to get a log into logstash, but I am stuck on parsing the last part of the first line. The last bit is a sentence with an error message, the only way to match this, is to use the EOL character, which I cannot get to work.
The example log line;
[2016-03-11 00:01:39.187 +0100CET] ERROR xxx-xxx-xxx ES1 appserver0 [xx-xx-xx] [xxx] com.intershop.beehive.core.internal.resource.ISFileBundle [] [Storefront] [xxx] [xx] "xx" Error creating bundle "css/mskCSSFile.css" com.intershop.beehive.core.capi.common.SystemException: Could not found source file with name "css/font-awesome-min.css"
at com.intershop.beehive.core.internal.resource.ISFileBundle.processResources(ISFileBundle.java:332)
at com.intershop.beehive.core.internal.resource.ISFileBundle.process(ISFileBundle.java:209)
at ish.cartridges.plus_005fapp_005fsf_005fmobile.default_.MobileGeneralHeader_jsp._jspService(MobileGeneralHeader_jsp.java:186)
I have the multiline setup that it does match on the date and splits events correctly. All of the fields up to the 'Error' is correctly placed into fields. But trying to get the last line into a field, by matching '\n' fails to work. Here is the config;
--8K--
filter {
multiline {
pattern => "^[%{TIMESTAMP_ISO8601}"
what => "previous"
negate => true
}
mutate {
replace => { "type" => "forwarder_java_error" }
# gsub => [ "message", "r", "" ]
}
grok {
match => [ "message", "(?m)[%{TIMESTAMP_ISO8601:timestamp} +%{INT}%{INT}%{INT}CET] ERROR %{HOSTNAME:myhostname} ES1 %{WORD:appserver_nr} [(?(\b\w+\b-|\b\w+\b){1,5})] [(?(-|\b\w+\b-|\b\w+\b){1,5})] %{HOSTNAME:javaclass} [] [%{WORD:storefront}] [(?<unknown_one>(-\b\w+\b-|\b\w+\b-|\b\w+\b){1,})] [(?<unknown_two>(-\b\w+\b-|\b\w+\b-|\b\w+\b){1,})] "(?<unknown_three>(-\b\w+\b-|\b\w+\b-|\b\w+\b){1,})" (?(.|\r|\n)*)%{GREEDYDATA:therest}" ]
overwrite => [ "message" ]
}
date {
match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
}
}
--8K--
Above is one of the many combinations I tried, thinking .*\n would be sufficient.
Can someone point me into the right direction?
Many thanks,
Soprano.