Filebeat Multiline problem

Elastic Stack Beats
1

Hi,
I am facing problem in multiline handling in Fileebeat.

below is the Error statcktrace:

2016-05-04 16:14:04,376 [http-bio-8443-exec-16] [username 87527E1A8A32B2F0CE4955E6598CC98D] ERROR com.tieto.its.sb.service.AbstractApplicationService - Exception Trace :: 
com.tieto.its.sc.exceptions.SystemException: null
	at com.tieto.its.sc.exceptions.ExceptionHandler.throwSystemException(ExceptionHandler.java:106)
	at com.tieto.its.rss.integration.impl.RssApplicationIntegration.handleRuntimeException(RssApplicationIntegration.java:78)
	at com.tieto.its.rss.integration.impl.RssApplicationIntegration.handleRestException(RssApplicationIntegration.java:52)
	at com.tieto.its.sc.restclient.AbstractRestClient.invoke(AbstractRestClient.java:90)
	at com.tieto.its.rss.integration.impl.VoucherSaleIntegration.retrievedistributedVoucherInfo(VoucherSaleIntegration.java:175)

FB configuration:

 multiline:
       pattern: "^com.|^[[:space:]]+at"
       negate: false
       match: after

Still its spanning across multiple rows in Kibana. Can anybody suggest correct pattern for this? I am not good in regex. :frowning:

br,
Sunil

2

I had a similar timestamp and solved it, with the help from steffens with the folowing:
pattern: '(^20[0-9]{2}(-[0-9]{2}){2} [0-9]{2}(:[0-9]{2}){2})'
and setting:
negate: true
match: after
which, per https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html

"Consecutive lines that don’t match the pattern are appended to the previous line that does match."