Events get combined

Elastic Stack Beats
1

I have multiline pattern as below.

multiline.pattern: ^\[0-9]{4}-[A-Za-z]{3}-[0-9]{2}
multiline.negate: true
multiline.match: after

My logs look like below.

2018-Apr-02 00:10:46 AM [http-nio-8888-exec-3] INFO  com.example.controller.SampleController - got request for hello
2018-Apr-02 00:10:52 AM [http-nio-8888-exec-1] INFO  com.example.controller.SampleController - got request for hello
2018-Apr-02 00:13:10 AM [http-nio-8888-exec-9] INFO  com.example.controller.SampleController - got request for hello
2018-Apr-02 00:13:38 AM [http-nio-8888-exec-7] ERROR com.example.controller.SampleController - exception
java.lang.NullPointerException: null
    at com.example.controller.SampleController.exception(SampleController.java:32) [classes!/:?]
    at sun.reflect.GeneratedMethodAccessor31.invoke(Unknown Source) ~[?:?]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_161]
    at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_161]

All the non-exception logs get combined and i see 1 entry on kibana.

The multiple exception messages also get combined and i see 1 entry on kibana.

I am not sure what i am missing. I dont have any include or exclude configuration. I am not using logstash.

2

I haven't tested your configuration, but when defining regexes, use single quotes.

The pattern config should be more like this:

multiline.pattern: '^[0-9]{4}-[A-Za-z]{3}-[0-9]{2}'

Btw. why did you put a \ before the first [ ?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.