Filebeat Java Regex

Hello guys,
i am having trouble getting my multiline regex to match my java stack traces.
Currently i am using

^([\s]{2,})+(at )|^Caused by:|^([\s]{3,})+([.]{3,})

An example stacktrace:

2019-06-26 15:44:24,176 http-nio-8080-exec-15 WARN anonymous 944x2728x2 3330qs 192.168.180.111 /s/ab0ef3d5e4bf36ca03b9da6df0865a7b-CDN/6o7uzl/802002/6411e0087192541a09d88223fb51a6a0/0065873bb66d07d780449c1bae566dc5/_/download/contextbat$
java.lang.RuntimeException: Cannot read resource content/js/util/DefaultMessageOptions.js
at com.atlassian.plugin.webresource.impl.snapshot.Resource$1.writeTo(Resource.java:200)
at com.atlassian.plugin.webresource.transformer.CompileTimeTransformer$1.writeTo(CompileTimeTransformer.java:59)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$8.writeTo(ResourceServingHelpers.java:466)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$4.streamResource(ResourceServingHelpers.java:332)
at com.atlassian.plugin.webresource.transformer.TransformerUtils.transformAndStreamResource(TransformerUtils.java:38)
at com.atlassian.plugin.webresource.transformer.CharSequenceDownloadableResource.streamResource(CharSequenceDownloadableResource.java:42)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$5.writeTo(ResourceServingHelpers.java:351)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$9.writeTo(ResourceServingHelpers.java:478)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$8.writeTo(ResourceServingHelpers.java:466)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$9.writeTo(ResourceServingHelpers.java:478)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$8.writeTo(ResourceServingHelpers.java:466)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$9.writeTo(ResourceServingHelpers.java:478)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$8.writeTo(ResourceServingHelpers.java:466)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$9.writeTo(ResourceServingHelpers.java:478)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$2.lambda$writeTo$0(ResourceServingHelpers.java:188)
at com.atlassian.plugin.cache.filecache.impl.PassThroughCache.cache(PassThroughCache.java:18)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$2.writeTo(ResourceServingHelpers.java:188)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$7.writeTo(ResourceServingHelpers.java:379)
at com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers$1.writeTo(ResourceServingHelpers.java:126)
at com.atlassian.plugin.webresource.impl.http.Controller.lambda$sendCachedInProduction$0(Controller.java:319)
at com.atlassian.plugin.cache.filecache.impl.OneStreamCache.streamToCache(OneStreamCache.java:83)
at com.atlassian.plugin.cache.filecache.impl.OneStreamCache$1.apply(OneStreamCache.java:40)
at com.atlassian.plugin.cache.filecache.impl.StreamsCache.doEnter(StreamsCache.java:76)
at com.atlassian.plugin.cache.filecache.impl.OneStreamCache.stream(OneStreamCache.java:36)
at com.atlassian.plugin.cache.filecache.impl.FileCacheImpl.cache(FileCacheImpl.java:87)
at com.atlassian.plugin.webresource.impl.http.Controller.sendCachedInProduction(Controller.java:319)
at com.atlassian.plugin.webresource.impl.http.Controller.sendCached(Controller.java:282)
at com.atlassian.plugin.webresource.impl.http.Controller.serveResources(Controller.java:222)
at com.atlassian.plugin.webresource.impl.http.Controller.serveBatch(Controller.java:84)
at com.atlassian.plugin.webresource.impl.http.Router$5.apply(Router.java:78)
at com.atlassian.plugin.webresource.impl.http.Router$5.apply(Router.java:71)
at com.atlassian.plugin.webresource.impl.support.http.BaseRouter.callHandler(BaseRouter.java:169)
at com.atlassian.plugin.webresource.impl.support.http.BaseRouter.dispatch(BaseRouter.java:144)
at com.atlassian.plugin.webresource.servlet.PluginResourceDownload.serveFile(PluginResourceDownload.java:65)
at com.atlassian.plugin.servlet.AbstractFileServerServlet.doGet(AbstractFileServerServlet.java:28)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:635)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
... 44 filtered
at com.atlassian.servicedesk.internal.web.ExternalCustomerLockoutFilter.doFilter(ExternalCustomerLockoutFilter.java:55)
... 4 filtered
at com.atlassian.jwt.internal.servlet.JwtAuthFilter.doFilter(JwtAuthFilter.java:37)
... 8 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 4 filtered
at com.atlassian.web.servlet.plugin.LocationCleanerFilter.doFilter(LocationCleanerFilter.java:36)
... 26 filtered
at com.atlassian.jira.servermetrics.MetricsCollectorFilter.doFilter(MetricsCollectorFilter.java:25)
... 25 filtered
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

I need something simple that i can understand.
I've tried this:

'[1]+(at|.{3})\b|^Caused by:'

Worked for most of the traces but it does not match ... 2 filtered for example. I need to match the entire stack trace as one message. I also need to match the ... filtered stuff and Caused by:
If there is a simple solution that takes a message from timestamp to timestamp will work for me in even more cases. I am pretty bad with regexes, i pray that you can help me and others in my pit :slight_smile:


  1. [:space:] ↩︎

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.