# Displaying the Full Exception and Caused By Message **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 7, 2018, 3:42pm UTC](https://discuss.elastic.co/t/displaying-the-full-exception-and-caused-by-message/143364 "2018-08-07T15:42:02Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\ **Post date:** [August 7, 2018, 3:42pm UTC](https://discuss.elastic.co/t/displaying-the-full-exception-and-caused-by-message/143364/1 "2018-08-07T15:42:03Z")
Hello, I am working on displaying the full error, exception and "caused by" portions of my logs. I used the following doc to install the ELK stack: > **[How To Install Elasticsearch, Logstash, and Kibana (ELK Stack) on CentOS 7 |...](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)** > > In this tutorial, we will go over the installation of the Elasticsearch ELK Stack on CentOS 7—that is, Elasticsearch 2.1.x, Logstash 2.1.x, and Kibana 4.3.x. We will also show you how to configure it to gather and visualize the syslogs of your... My error example: ``` 2018-03-01 10:24:20.014 ERROR 32649 --- [Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa0]] org.thymeleaf.TemplateEngine : [THYMELEAF][Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa]] Exception processing template "something.txt": An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt") org.thymeleaf.exceptions.TemplateInputException: An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt") at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) ~[na:1.8.0_91] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) ~[na:1.8.0_91] Caused by: java.io.FileNotFoundException: /usr/share/apache-tomcat-8.0.28/webapps/something.txt (No such file or directory) at org.thymeleaf.templateresource.FileTemplateResource.reader(FileTemplateResource.java:102) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE] at org.thymeleaf.templateparser.text.AbstractTextTemplateParser.parse(AbstractTextTemplateParser.java:156) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE] ... 40 common frames omitted ``` Currently, I am not able to discover the entire message as seen above but only in parts for example: ``` 2018-03-01 10:24:20.014 ERROR 32649 --- [Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa0]] org.thymeleaf.TemplateEngine : [THYMELEAF][Camel (camel-1) thread #28 - JmsConsumer[Consumer.NOTIFICATION.VirtualTopic.notification.push.processor.handlePushQueued.qa]] Exception processing template "something.txt": An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt") org.thymeleaf.exceptions.TemplateInputException: An error happened during template parsing (template: "/usr/share/apache-tomcat-8.0.28/webapps/something.txt") at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) ~[na:1.8.0_91] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) ~[na:1.8.0_91] ``` and: ``` Caused by: java.io.FileNotFoundException: /usr/share/apache-tomcat-8.0.28/webapps/something.txt (No such file or directory) at org.thymeleaf.templateresource.FileTemplateResource.reader(FileTemplateResource.java:102) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE] at org.thymeleaf.templateparser.text.AbstractTextTemplateParser.parse(AbstractTextTemplateParser.java:156) ~[thymeleaf-3.0.3.RELEASE.jar!/:3.0.3.RELEASE] ... 40 common frames omitted ``` Here is the pattern i'm currently using on filebeat: ``` multiline.pattern: ^=[A-Z]+|^$ multiline.negate: false multiline.match: after ``` Is there a way to group the entire message so that i can view it in one search? Also, I have over 100 servers i need to make this change on. Is there a simpler way to enable multiline other than updating each one of their filebeat files individually? ---
**Author:** ![chandra0651](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chandra0651/32/30484_2.png) [@chandra0651](https://discuss.elastic.co/u/chandra0651)\ **Post date:** [August 7, 2018, 5:54pm UTC](https://discuss.elastic.co/t/displaying-the-full-exception-and-caused-by-message/143364/2 "2018-08-07T17:54:01Z")
If i understood your question if you want to see all the log as one document ,if so please use the below multiline pattern in filebeat > multiline.pattern: '\[1\]{4}-[0-9]{2}-[0-9]{2}' > multiline.negate: true > multiline.match: after * * * 1. 0-9 ---
**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\ **Post date:** [August 7, 2018, 7:45pm UTC](https://discuss.elastic.co/t/displaying-the-full-exception-and-caused-by-message/143364/3 "2018-08-07T19:45:34Z")
Thanks @chandra0651, the main issue i'm having is that when I run a search for "Error" I only get the first line rather than the entire output. My goal is to include the entire error message on one visualization. At the moment, the pattern below displays the message lines that follow "Caused by" but only if I run a search with keywords "Caused by" but it still won't display anything else: `multiline.pattern: ^[[:space:]]` ---
**Author:** ![chandra0651](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chandra0651/32/30484_2.png) [@chandra0651](https://discuss.elastic.co/u/chandra0651)\ **Post date:** [August 7, 2018, 7:58pm UTC](https://discuss.elastic.co/t/displaying-the-full-exception-and-caused-by-message/143364/4 "2018-08-07T19:58:47Z")
Hello @Luis_Alejandro_Galan As said if you use the multi line pattern which i have shared it will group all the message as one event and sends them to ES. So when you search with "ERROR" it will display the whole message.instead breaking them into multiple documents in ES ---
**Author:** ![Luis\_Alejandro\_Galan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luis_alejandro_galan/32/32746_2.png) [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\ **Post date:** [August 7, 2018, 8:38pm UTC](https://discuss.elastic.co/t/displaying-the-full-exception-and-caused-by-message/143364/5 "2018-08-07T20:38:28Z")
I missed setting the "multiline.negate:" to "true" so it wasn't registering properly at first. This is exactly what we needed. Thanks @chandra0651!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2018, 8:38pm UTC](https://discuss.elastic.co/t/displaying-the-full-exception-and-caused-by-message/143364/6 "2018-09-04T20:38:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.