# Grok filter cant split error message and java stacktrace into fields

**URL:** <https://discuss.elastic.co/t/grok-filter-cant-split-error-message-and-java-stacktrace-into-fields/88824>\
**Category:** Logstash\
**Created:** [June 9, 2017, 10:13am UTC](https://discuss.elastic.co/t/grok-filter-cant-split-error-message-and-java-stacktrace-into-fields/88824 "2017-06-09T10:13:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![trousse](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@trousse](https://discuss.elastic.co/u/trousse)\
**Post date:** [June 9, 2017, 10:13am UTC](https://discuss.elastic.co/t/grok-filter-cant-split-error-message-and-java-stacktrace-into-fields/88824/1 "2017-06-09T10:13:05Z")

</div>

i'm tryning that parse logs from a tomcat server which write javastacktrace after error like :

"[ERROR - 18:02:00.028, org.springframework.scheduling.support.TaskUtils$LoggingErrorHandler-95] Unexpected error occurred in scheduled task.  
org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar [[query]]; nested exception is java.sql.SQLSyntaxErrorException: ORA-00942: Table ou vue inexistante

```
at org.springframework.jdbc.support.SQLErrorCodeSQLExceptionTranslator.doTranslate(SQLErrorCodeSQLExceptionTranslator.java:231) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:73) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:660) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:695) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:727) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:737) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]

```

..."

i want to split the javastack trace and the error message into 2 different field that is my curents conf file :

_ **logstash conf file :** _

input{  
redis{  
host =\> ["\*\*\*.\*\*\*.\*\*\*.\*\*\*"]  
port =\> 6379  
key =\> mercure\_log\_queu  
data\_type =\> list  
}  
}  
filter{  
grok{  
patterns\_dir =\> ["/etc/logstash/patterns/extra\_patters"]  
match =\> {"message" =\> "%{mercure}"}  
}  
}

output{  
elasticsearch{  
hosts =\> ["\*\*\*.\*\*\*.\*\*\*.\*\*\*:9200"]  
manage\_template =\> false  
}  
file{  
path =\> "/var/log/logstash/mercure\_logs"  
}  
}

_ **%{mercure} pattern :** _

mercure [%{LOGLEVEL:loglevel}%{SPACE}%{NOTSPACE}%{SPACE}%{TIME:time}, %{NOTSPACE:java\_class} ((%{JAVALOGMESSAGE:logmessage}\n%_{JAVASTACKTRACEPART_}\*)|%{JAVALOGMESSAGE:logmessage})

_ **filebeat prospector :** _

- input\_type: log

**_result :_**

in Kibana i could seen the logmessage field = error+javastacktrace - last line of java stack trace :

(logmessage =" Unexpected error occurred in scheduled task.  
org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar [[query]]; nested exception is java.sql.SQLSyntaxErrorException: ORA-00942: Table ou vue inexistante

```
at org.springframework.jdbc.support.SQLErrorCodeSQLExceptionTranslator.doTranslate(SQLErrorCodeSQLExceptionTranslator.java:231) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:73) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:660) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:695) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE]
at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:727) ~[spring-jdbc-4.1.5.RELEASE.jar:4.1.5.RELEASE] ")

```

when i try that pattern in grok test pattern the parser work so i dont understand what happend bad  
could you enlighten me pleas 🙂

PING

---

<div class="post-metadata">

**Author:** ![trousse](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@trousse](https://discuss.elastic.co/u/trousse)\
**Post date:** [June 12, 2017, 7:33am UTC](https://discuss.elastic.co/t/grok-filter-cant-split-error-message-and-java-stacktrace-into-fields/88824/2 "2017-06-12T07:33:09Z")

</div>

no body could help me ?  
PING

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2017, 7:33am UTC](https://discuss.elastic.co/t/grok-filter-cant-split-error-message-and-java-stacktrace-into-fields/88824/3 "2017-07-10T07:33:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.