Filebeat multiline patern loglevel match

The log has the following view:

[WARNING]	[HOSTNAME]	[Servicename.Web.Node2]	[https://google.com/application/WebModules/AdminTools/UsersSessionInfo/UsersSessionInfo.aspx]	[12/26/2019 15:34:27.569]	[DOMAIN\USER]	[CLUSTERING]	[Cluster:721:GetOtherSessions]	Error while trying to retrieve sessions information from node 'hostname'. Reason: System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at https://google.com/application/WebServices/WCF/Clustering/ClusteringService.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.168.0.1:443
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
   --- End of inner exception stack trace ---
   at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
   at System.Net.HttpWebRequest.GetRequestStream()
   at System.ServiceModel.Channels.HttpOutput.WebRequestHttpOutput.GetOutputStream()
   --- End of inner exception stack trace ---

Server stack trace: 
   at System.ServiceModel.Channels.HttpOutput.WebRequestHttpOutput.GetOutputStream()
   at System.ServiceModel.Channels.HttpOutput.Send(TimeSpan timeout)
   at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.SendRequest(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.RequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Dispatcher.RequestChannelBinder.Request(Message message, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at Selerant.ApplicationBlocks.Clustering.Service.IClusteringService.GetSessions()
   at Selerant.ApplicationBlocks.Clustering.Service.ClusteringServiceClient.GetSessions()
   at Selerant.ApplicationBlocks.Clustering.Cluster.GetOtherSessions(BaseNode server)	[]	[26]
[ERROR]	[HOSTNAME]	[Servicename.Web.Node2]	[https://google.com/application/WebModules/AdminTools/UsersSessionInfo/UsersSessionInfo.aspx]	[12/26/2019 15:34:27.569]	[DOMAIN\USER]	[]	[DevExBasePage:1109:DevExPage_Error]	Unmanaged exception. The following exception was thrown: System.NullReferenceException: Object reference not set to an instance of an object.
   at Selerant.DevEx.WebModules.AdminTools.UsersSessionInfo.UsersSessionCtrl.FillSessionsInfosGrid()
   at Selerant.DevEx.WebModules.AdminTools.UsersSessionInfo.UsersSessionCtrl.FillGrids()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)	[]	[26]

Each log entry starts with log level such us [WARNING] or [ERROR], I need to strictly specify it in filebeat configuration for matching each log entries.
The question is, how to specify it in multiline.pattern?

1 Like

multiline.pattern expects a regex. If your lines start with either [WARNING] or [ERROR] I suggest you go with the following pattern:

multiline.pattern: ^(\[ERROR\]|\[WARNING\])

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.