Formatting strings using scripted fields - inserting line breaks

[Warren]

My 'message' contains a stacktrace / exception error like below.
But the string is not easy to read in Kibana. I need to insert new lines on each trace line.. so it's neat and tidy etc..
I've read that I can use scripted fields to achieve this, and the painless would look like this?

doc['message'].value = "\n" + "
"

But the script does not work. How can I replace \n in the strack trace so my messages are on new lines in Kibana?

[2018-06-07 11:02:33] testing.ERROR: Class 'App\Http\Controllers\Deal' not found {"exception":"[object] (Symfony\Component\Debug\Exception\FatalThrowableError(code: 0): Class 'App\Http\Controllers\Deal' not found at /app/Http/Controllers/TestingSyslogController.php:13)\n[stacktrace]\n#0 [internal function]: App\Http\Controllers\TestingSyslogController->index()\n#1 /vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): call_user_func_array(Array, Array)\n#2 /vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(45): Illuminate\Routing\Controller->callAction('index', Array)\n#3 /vendor/laravel/framework/src/Illuminate/Routing/Route.php(212): Illuminate\Routing\ControllerDispatcher->dispatch(Object(Illuminate\Routing\Route), Object(App\Http\Controllers\TestingSyslogController), 'index')\n#4 /vendor/laravel/framework/src/Illuminate/Routing/Route.php(169): Illuminate\Routing\Route->runController()\n#5

[rashmi (kulkarni)]

You can write a formatter function that truncated the line or splits it with a line-break (using HTML
tag).(https://www.elastic.co/guide/en/kibana/current/scripted-fields.html )( available 5.0 and above)

CHeers
Rashmi

[Warren]

I'll convert this inline script to scripted fields I guess

https://www.elastic.co/guide/en/x-pack/5.5/ml-configuring-transform.html#ml-configuring-transform6

Amazed there are no working examples of stack trace handling in kibana. I tried logstash & grok filtering already.... was hoping this scripted fields might offer a good alternative.

I might just write a custom log in json format and send it directly to logstash.

[rashmi (kulkarni)]

@Warren

of stack trace handling in kibana. I tried logstash & grok filtering already.... was hoping this scripted fields might offer a good alternative.

I might just write a custom log in json format and send it directly to logstash.

You need to parse that at index time itself. Scripted field will get you there, and is the only option if it's already indexed, but not a prob for Kibana to solve, the workflow for that is done pre-kibana.

Cheers
Rashmi

[Warren]

I've tried scripted fields, I've used lang=painless, type=string, format=string,
script=/\n/.matcher(doc['message'].value).replaceAll('
')

but then I receive this error
"Courier Fetch: 10 of 715 shards failed.

The script might be written wrong...

I've tried

1. doc['message'].value = "\n" + "
   

2. /\n/.matcher(doc['message'].value).replaceAll('
   ')

Wondering how I can debug or test a scripted field......