Extracting data from multiline error message

Elastic Stack Logstash
1

Hello everyone,

would be very gratefull for a hint. I have a multiline message and I need to extract some info from multiline error (Producer.scala:77): one column Producer.scala and the next one is number of error (77). What would be the best and reliable way to do that: 1) since it comes as one multiline message, define GROK pattern for each incoming line separated by \n. But since the number of lines varies, I get grokparsefailure. 2) using IF condition, but it still needs a valid GROK pattern. Are there any other options how to do that?

Thanks for your help!!
Kafka|690x167

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.