Extracting data from multiline error message

Hello everyone,

would be very gratefull for a hint. I have a multiline message and I need to extract some info from multiline error (Producer.scala:77): one column Producer.scala and the next one is number of error (77). What would be the best and reliable way to do that: 1) since it comes as one multiline message, define GROK pattern for each incoming line separated by \n. But since the number of lines varies, I get grokparsefailure. 2) using IF condition, but it still needs a valid GROK pattern. Are there any other options how to do that?

Thanks for your help!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.