# \[GROK\]\[Pattern\] Match any char except \\n

**URL:** <https://discuss.elastic.co/t/grok-pattern-match-any-char-except-n/94089>\
**Category:** Logstash\
**Created:** [July 21, 2017, 9:43am UTC](https://discuss.elastic.co/t/grok-pattern-match-any-char-except-n/94089 "2017-07-21T09:43:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ThaPoox](https://avatars.discourse-cdn.com/v4/letter/t/9e8a1a/32.png) [@ThaPoox](https://discuss.elastic.co/u/ThaPoox)\
**Post date:** [July 21, 2017, 9:43am UTC](https://discuss.elastic.co/t/grok-pattern-match-any-char-except-n/94089/1 "2017-07-21T09:43:49Z")

</div>

So I have this log data:

> ```
> > 12:03:55,117 ERROR [My.Super.Cool.Java.Class] (main-executor-threads - 213) This is an Exception message example: package.myProject.MyException: You cannot do whatever you are trying to do because of this Exception
> > at My.Super.Cool.Java.Class.MySuperMethod(MyJavaFile.java:123) [Slakh-6.4.3.7.jar:] 
> > at My.Super.Cool.Java.Class2.MySuperMethod2(MyJavaFile2.java:123) [classes:]
> > at RestOfStackTrace...
> 
> ```

Here's the result I'm looking for:

> ```
> "@version": "1",
> 
> ```
> 
> ...  
> ...  
> "Level": "ERROR",  
> "Exception": "package.myProject.MyException"  
> "ExceptionMessage": "You cannot do whatever you are trying to do because of this Exception"

And here's what I'm getting:

> ```
> > "@version": "1",
> > ...
> > ...
> > "Level": "ERROR",
> > "Exception": "package.myProject.MyException: You cannot do whatever you are trying to do because of this Exception\n\tat My.Super.Cool.Java.Class.MySuperM..."
> > "ExceptionMessage": " You cannot do whatever you are trying to do because of this Exception\n\tat My.Super.Cool.Java.Class.MySuperM..."
> 
> ```

Here is my filter:

> ```
> > MY_EXCEPTION package.myProject.MyException:\s%{GREEDYDATA:ExceptionMessage}
> > ...%{ERROR:Level}\s*%{GREEDYDATA}%{MY_EXCEPTION:Exception}%{GREEDYDATA}...
> 
> ```

To sum up, what I want is to tell Grok that for " **ExceptionMessage**"; it should take only what's after " **package.myProject.MyException**" IN THAT LINE. It should leave all what's after the second line.  
I spent some time looking for that pattern but I couldn't solve this issue, so I'm kind of stuck here.

I hope my problem is clear.

Thank you.

---

<div class="post-metadata">

**Author:** ![Xavy](https://avatars.discourse-cdn.com/v4/letter/x/e0b2c6/32.png) [@Xavy](https://discuss.elastic.co/u/Xavy)\
**Post date:** [July 21, 2017, 10:09am UTC](https://discuss.elastic.co/t/grok-pattern-match-any-char-except-n/94089/2 "2017-07-21T10:09:01Z")

</div>

Hello  
Have you thought about using multiline codec, and on it, using max\_lines setting?:

[https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#plugins-codecs-multiline-max\_lines](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#plugins-codecs-multiline-max_lines)

---

<div class="post-metadata">

**Author:** ![ThaPoox](https://avatars.discourse-cdn.com/v4/letter/t/9e8a1a/32.png) [@ThaPoox](https://discuss.elastic.co/u/ThaPoox)\
**Post date:** [July 21, 2017, 10:34am UTC](https://discuss.elastic.co/t/grok-pattern-match-any-char-except-n/94089/3 "2017-07-21T10:34:01Z")

</div>

Thank you for your answer.  
I think that if I use the max\_lines setting, I will lose all the rest of the StackTrace... am I right?  
Because I show the whole StackTrace at first and then I apply the filters on it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2017, 10:34am UTC](https://discuss.elastic.co/t/grok-pattern-match-any-char-except-n/94089/4 "2017-08-18T10:34:13Z")

</div>

Closed on August 18, 2017, 10:34am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.