FIlebeat multiline pattern

Elastic Stack Beats
1

I have log file with multiline events:

    4773 [Access(63)-21-02.00-dxf_laboratories] ERROR 2017-12-14T17:29:38.946 com.utils.CommonUtils  - event=Laboratory - dv_laboratories recordKey=nullTest || errorMessage=ERROR_TRANSMITTING  
javax.jms.JMSException: Could not create Transport. Reason: java.lang.NullPointerException
	at org.apache.activemq.util.JMSExceptionSupport.create(JMSExceptionSupport.java:36)
	at org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:120)
	at org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:332)
	at org.apache.activemq.ActiveMQConnectionFactory.createActiveMQConnection(ActiveMQConnectionFactory.java:305)
	at org.apache.activemq.ActiveMQConnectionFactory.createConnection(ActiveMQConnectionFactory.java:245)
	at com.utils.CommonUtils.getProducer(CommonUtils.java:127)
	at com.utils.CommonUtils.sendBatch(CommonUtils.java:94)
	at com.storedprocedures.Labs.send(Labs.java:91)
	at com.storedprocedures.Labs.process(Labs.java:72)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
	at com.davita.cwow.utils.StoredProcedureUtils.doCall(StoredProcedureUtils.java:123)
	at com.denodo.vdb.engine.storedprocedure.StoredProcedureWorker.run(Unknown Source)
	at com.denodo.vdb.engine.thread.g.a(Unknown Source)
	at com.denodo.vdb.engine.thread.ReusableThread.run(Unknown Source)
Caused by: java.lang.NullPointerException
	at org.apache.activemq.ActiveMQSslConnectionFactory.createTrustManager(ActiveMQSslConnectionFactory.java:133)
	at org.apache.activemq.ActiveMQSslConnectionFactory.createTransport(ActiveMQSslConnectionFactory.java:113)
	... 15 more

everything else start with this pattern "%-4r [%t] %-5p %d{yyyy-MM-dd'T'HH:mm:ss.SSS} %c %x - %m %n"

How does the multiline handle situations like that? Whats the best way to match against multiple patterns in the same file?

2

Figured it out!

Enabled these properties in yml file:
multiline.pattern: Exception:+|at +|Caused by:+|more
multiline.negate: false
multiline.match: after

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.