# Filebeat with graylog collector sidecar - java.lang.NullPointerException

**URL:** <https://discuss.elastic.co/t/filebeat-with-graylog-collector-sidecar-java-lang-nullpointerexception/174424>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 28, 2019, 8:22pm UTC](https://discuss.elastic.co/t/filebeat-with-graylog-collector-sidecar-java-lang-nullpointerexception/174424 "2019-03-28T20:22:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![delsdam](https://avatars.discourse-cdn.com/v4/letter/d/ba9def/32.png) [@delsdam](https://discuss.elastic.co/u/delsdam)\
**Post date:** [March 28, 2019, 8:22pm UTC](https://discuss.elastic.co/t/filebeat-with-graylog-collector-sidecar-java-lang-nullpointerexception/174424/1 "2019-03-28T20:22:30Z")

</div>

Hello,

I installed graylog collector sidecar with filebeat (6.4.1).  
In the file catalina.out, I have the message below:

java.lang.NullPointerException: null  
at org.zkoss.zk.ui.AbstractComponent.getAttachedUiEngine (AbstractComponent.java:373)  
at org.zkoss.zk.ui.AbstractComponent.smartUpdate (AbstractComponent.java:1851)  
at org.zkoss.zk.ui.AbstractComponent.smartUpdate (AbstractComponent.java:1825)  
at org.zkoss.zk.ui.AbstractComponent.smartUpdate (AbstractComponent.java:1891)  
at org.zkoss.zk.ui.AbstractComponent.setVisible (AbstractComponent.java:1616)

In the filebeat.yaml file, here is my configuration:

filebeat:  
prospectors:

- encoding: plain  
exclude\_files:   
fields:  
collector\_node\_id: lweb3  
gl2\_source\_collector: 2fd7216b-8a47-4a58-bb4b-32b1889c7e95  
type: log  
ignore\_older: 0  
multiline:  
match: after  
negate: false  
pattern: '^ [[: space:]]'  
paths:
  - /var/log/apache2/\*.log
  - /opt/tomcat8/logs/\*.out  
scan\_frequency: 10s  
tail\_files: true  
type: log  
output:  
logstash:  
hosts:
  - graylog.domain.local: 5044  
path:  
data: / var / cache / graylog / collector-sidecar / filebeat / data  
logs: / var / log / graylog / collector-sidecar  
tags:

- linux
- apache

The problem is that all lines are separated instead of having the entire message.

I think my regex is incorrect but I can not find the solution.

Can you help me please?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [March 29, 2019, 11:57am UTC](https://discuss.elastic.co/t/filebeat-with-graylog-collector-sidecar-java-lang-nullpointerexception/174424/2 "2019-03-29T11:57:41Z")

</div>

Could you please format your configuration using `</>`? This preserves whitespaces in the config, so it's make detecting whitespace errors possible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2019, 11:57am UTC](https://discuss.elastic.co/t/filebeat-with-graylog-collector-sidecar-java-lang-nullpointerexception/174424/3 "2019-04-26T11:57:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.