Displaying the Full Exception and Caused By Message

Elastic Stack Beats
1

Hello, I am working on displaying the full error, exception and "caused by" portions of my logs. I used the following doc to install the ELK stack:

My error example:

2018-03-01 10:24:20.014 ERROR 32649 --- [Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa0]] org.thymeleaf.TemplateEngine             : [THYMELEAF][Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa]] Exception processing template "something.txt": An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt")

org.thymeleaf.exceptions.TemplateInputException: An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt")
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) ~[na:1.8.0_91]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) ~[na:1.8.0_91]
Caused by: java.io.FileNotFoundException: /usr/share/apache-tomcat-8.0.28/webapps/something.txt (No such file or directory)
	at org.thymeleaf.templateresource.FileTemplateResource.reader(FileTemplateResource.java:102) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE]
	at org.thymeleaf.templateparser.text.AbstractTextTemplateParser.parse(AbstractTextTemplateParser.java:156) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE]
	... 40 common frames omitted

Currently, I am not able to discover the entire message as seen above but only in parts for example:

2018-03-01 10:24:20.014 ERROR 32649 --- [Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa0]] org.thymeleaf.TemplateEngine             : [THYMELEAF][Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa]] Exception processing template "something.txt": An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt")
org.thymeleaf.exceptions.TemplateInputException: An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt")
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) ~[na:1.8.0_91]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) ~[na:1.8.0_91]

and:

Caused by: java.io.FileNotFoundException: /usr/share/apache-tomcat-8.0.28/webapps/something.txt (No such file or directory)
	at org.thymeleaf.templateresource.FileTemplateResource.reader(FileTemplateResource.java:102) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE]
	at org.thymeleaf.templateparser.text.AbstractTextTemplateParser.parse(AbstractTextTemplateParser.java:156) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE]
	... 40 common frames omitted

Here is the pattern i'm currently using on filebeat:

multiline.pattern: ^=[A-Z]+|^$
multiline.negate: false
multiline.match: after

Is there a way to group the entire message so that i can view it in one search?

Also, I have over 100 servers i need to make this change on. Is there a simpler way to enable multiline other than updating each one of their filebeat files individually?

2

If i understood your question if you want to see all the log as one document ,if so please use the below multiline pattern in filebeat

multiline.pattern: '[1]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

  1. 0-9 ↩︎

3

Thanks @chandra0651, the main issue i'm having is that when I run a search for "Error" I only get the first line rather than the entire output. My goal is to include the entire error message on one visualization. At the moment, the pattern below displays the message lines that follow "Caused by" but only if I run a search with keywords "Caused by" but it still won't display anything else:
multiline.pattern: ^[[:space:]]

4

Hello @Luis_Alejandro_Galan As said if you use the multi line pattern which i have shared it will group all the message as one event and sends them to ES. So when you search with "ERROR" it will display the whole message.instead breaking them into multiple documents in ES

1 Like
5

I missed setting the "multiline.negate:" to "true" so it wasn't registering properly at first. This is exactly what we needed. Thanks @chandra0651!!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.