Filebeat startup error (multiline)


(Little Five) #1

Use filebeat to collect logs. There are many lines in the collected log that need to be merged into one line. After referring to the official documentation, the following errors are reported:
2018-05-25T15:07:55.442+0800 ERROR instance/beat.go:667 Exiting: Error in initing prospector: missing required field accessing 'filebeat.prospectors.2.multiline.pattern' (source:'filebeat.yml')


My configuration is as follows:
filebeat.prospectors:
# appLogs
- paths: ["/var/log/onigiri/app.onigiri/*2018-05*log"]
  # The following fields are custom added
  fields:
    type: "ftjf-applogs"

# customerLogs
- paths: ["/var/log/onigiri/customer.onigiri/*2018-05*log"]
  # The following fields are custom added
  fields:
    type: "ftjf-customerlogs"

# tomcat_manager catalina.out
- paths: ["/usr/local/tomcat_manage/logs/catalina.out"]

  # multiline
  multiline.patten: '^[[:space:]]+(at{4})'
  multiline.negate: true
  multiline.match: after

  # The following fields are custom added
  fields:
    type: "ftjf-manager-tomcat-log"

source log
    ERROR [2018-05-23 15:10:33,874]-[http-bio-8088-exec-61] com.iqb.onigiri.bgfront.rest.assets.BorrowInfoRest:321 - IQB异常信息---系统异常:{"addTime":"2018-05-23","applyamt":200000,"bankName":"hello","cardNum":"6225883718705713","channal":"CHANNAL_RAR","checkTime":1527059433,"creditType":0,"deadline":1529683200,"guaBankCity":"郑州市","guaBankName":"中国银行","guaCardNum":"888888888888888888","guaCreditCode":"91410105MA3XE3C11T","guarantee":"hello","guaranteeIdCard":"412728198410070837","housePledged":0,"houseType":0,"idCard":"370404199006301915","loanIdcard":"412728198410070837","loanName":"程文明","loanType":0,"msgType":"asset_allocation","phone":"13838546864","projectCode":"ZZLD18040001","projectId":819,"projectName":"一二三ZZLD18040001","projectType":"2002","pushTime":"2018-05-23 15:10:33","raiseObj":"公司","raiseTotalAmount":200000,"trulyLoanType":0,"userName":"皮晴晴","vehicleIdNo":"46das5f4as54f546","vehiclePlate":"d4sa6f44as","vehicleType":"法拉利f12"} 
    net.sf.json.JSONException: JSONObject["guaranteeName"] not found.
        at net.sf.json.JSONObject.getString(JSONObject.java:2092) ~[json-lib-2.4-jdk15.jar:na]
    	at com.iqb.onigiri.bgfront.server.assets.service.impl.BorrowInfoService.insertBorrowInfoFromAssetSysNew(BorrowInfoService.java:585) ~[BorrowInfoService.class:na]
    	at com.iqb.onigiri.bgfront.rest.assets.BorrowInfoRest.insertBorrowInfoFromAssetSysNew(BorrowInfoRest.java:318) ~[BorrowInfoRest.class:na]
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.7.0_71]
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) ~[na:1.7.0_71]
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.7.0_71]
    	at java.lang.reflect.Method.invoke(Method.java:606) ~[na:1.7.0_71]
    	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959) [spring-webmvc-4.1.6.RELEASE.jar:4.1.6.RELEASE]
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) [catalina.jar:7.0.57]
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421) [catalina.jar:7.0.57]
    	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070) [tomcat-coyote.jar:7.0.57]
    	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) [tomcat-coyote.jar:7.0.57]
    	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314) [tomcat-coyote.jar:7.0.57]
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_71]
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_71]
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-coyote.jar:7.0.57]
    	at java.lang.Thread.run(Thread.java:745) [na:1.7.0_71]

(Mehmet Sezgin) #2

There is a typo setting below. it should be "multiline.pattern"


(Little Five) #3

I am careless, thank you very much.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.