HI.
I have a exceptions in logstash.err file
Exception: java.lang.ThreadDeath thrown from the UncaughtExceptionHandler in thread "Thread-482"
This topic is similar to Exception: java.lang.ThreadDeath thrown from the UncaughtExceptionHandler in thread - logstash.err
But multiline disable not helped to me.
Configs:
/etc/logstash/conf.d/01-lumberjack-input.conf
input {
lumberjack {
port => 5000
type => "logs"
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
http {
port => 8081
type => clientlog
codec => "json"
}
}
/etc/logstash/conf.d/10-syslog.conf
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
/etc/logstash/conf.d/11-nginx.conf
filter {
if [type] == "nginx-access" {
grok {
match => { "message" => "%{NGINXACCESS}" }
}
}
}
/etc/logstash/conf.d/12-tomcat.conf
filter {
if [type] == "tomcat" {
multiline {
pattern => "(^%{TOMCAT_DATESTAMP}|^%{CATALINA_DATESTAMP})"
negate => true
what => "previous"
}
grok {
match => { "message" => "(?m)%{TOMCAT_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
}
if "_grokparsefailure" in [tags] {
grok {
match => { "message" => "(?m)%{CATALINA_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
remove_tag => ["_grokparsefailure"]
}
}
mutate {
replace => [ "message", "%{content}" ]
remove_field => ["content"]
add_field => { "uuid" => "%{@timestamp}%{host}%{message}" }
}
anonymize {
algorithm => "SHA256"
fields => ["uuid"]
key => "colorbar"
}
throttle {
before_count => -1
after_count => 1
period => 86400
key => "%{host}%{message}"
add_tag => "throttled"
}
if [message] =~ /exception/ or [message] =~ /Exception/ or [message] =~ /EXCEPTION/ {
mutate {
add_tag => "exception"
}
}
}
}
/etc/logstash/conf.d/13-tomcat.conf
filter {
if [type] == "tomcatn" {
multiline {
pattern => "------------------------------------------------------------"
negate => true
what => "previous"
}
grok {
match => { "message" => "(?m)%{TOMCAT_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
}
if "_grokparsefailure" in [tags] {
grok {
match => { "message" => "(?m)%{CATALINA_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
remove_tag => ["_grokparsefailure"]
}
}
if "_grokparsefailure" in [tags] {
drop { }
}
mutate {
replace => [ "message", "%{content}" ]
remove_field => ["content"]
add_field => { "uuid" => "%{@timestamp}%{host}%{message}" }
}
anonymize {
algorithm => "SHA256"
fields => ["uuid"]
key => "colorbar"
}
throttle {
before_count => -1
after_count => 1
period => 86400
key => "%{host}%{message}"
add_tag => "throttled"
}
if [message] =~ /ERROR.*exception/ or [message] =~ /ERROR.*Exception/ or [message] =~ /ERROR.*EXCEPTION/ {
mutate {
add_tag => "exception"
}
}
}
}
/etc/logstash/conf.d/30-lumberjack-output.conf
output {
if "throttled" not in [tags] {
if "exception" in [tags] {
email {
from => "noreply@mail.com"
subject => "Exception on %{host} id: %{uuid}"
to => "support@mail.com"
body => "Exception on %{host}:\n\n%{message}"
}
}
}
elasticsearch { host => localhost }
exec {
command => "touch /var/run/logstash-heartbeat"
}
}
logstash 1.5.4
Linux log 3.2.0-4-amd64 #1 SMP Debian 3.2.68-1+deb7u1 x86_64 GNU/Linux
java version "1.8.0_45"
Java(TM) SE Runtime Environment (build 1.8.0_45-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode)