Filebeat with graylog collector sidecar - java.lang.NullPointerException

Elastic Stack Beats
1

Hello,

I installed graylog collector sidecar with filebeat (6.4.1).
In the file catalina.out, I have the message below:

java.lang.NullPointerException: null
at org.zkoss.zk.ui.AbstractComponent.getAttachedUiEngine (AbstractComponent.java:373)
at org.zkoss.zk.ui.AbstractComponent.smartUpdate (AbstractComponent.java:1851)
at org.zkoss.zk.ui.AbstractComponent.smartUpdate (AbstractComponent.java:1825)
at org.zkoss.zk.ui.AbstractComponent.smartUpdate (AbstractComponent.java:1891)
at org.zkoss.zk.ui.AbstractComponent.setVisible (AbstractComponent.java:1616)

In the filebeat.yaml file, here is my configuration:

filebeat:
prospectors:

  • encoding: plain
    exclude_files:
    fields:
    collector_node_id: lweb3
    gl2_source_collector: 2fd7216b-8a47-4a58-bb4b-32b1889c7e95
    type: log
    ignore_older: 0
    multiline:
    match: after
    negate: false
    pattern: '^ [[: space:]]'
    paths:
    • /var/log/apache2/*.log
    • /opt/tomcat8/logs/*.out
      scan_frequency: 10s
      tail_files: true
      type: log
      output:
      logstash:
      hosts:
    • graylog.domain.local: 5044
      path:
      data: / var / cache / graylog / collector-sidecar / filebeat / data
      logs: / var / log / graylog / collector-sidecar
      tags:
  • linux
  • apache

The problem is that all lines are separated instead of having the entire message.

I think my regex is incorrect but I can not find the solution.

Can you help me please?

2

Could you please format your configuration using </>? This preserves whitespaces in the config, so it's make detecting whitespace errors possible.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.