# GROK pattern to collect whole exception stacktrace

**URL:** <https://discuss.elastic.co/t/grok-pattern-to-collect-whole-exception-stacktrace/208295>\
**Category:** Logstash\
**Created:** [November 18, 2019, 11:01am UTC](https://discuss.elastic.co/t/grok-pattern-to-collect-whole-exception-stacktrace/208295 "2019-11-18T11:01:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gyana\_nayak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gyana_nayak/32/56498_2.png) [@gyana\_nayak](https://discuss.elastic.co/u/gyana_nayak)\
**Post date:** [November 18, 2019, 11:01am UTC](https://discuss.elastic.co/t/grok-pattern-to-collect-whole-exception-stacktrace/208295/1 "2019-11-18T11:01:34Z")

</div>

Hi All,  
Below config file not capturing complete stacktrace, it is only collecting single line. Any suggestion how can collect whole stacktrace.

```
filter {

      #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
      if [message] =~ "\tat" {
        grok {
          match => ["message", "^(\tat)"]
          add_tag => ["stacktrace"]
        }
      }

      grok {
      match => [ "message",
               "%{DATESTAMP_EVENTLOG:timestamp}%{SPACE}%{LOGLEVEL:log_level}%{SPACE}%{WORD:method}%{SPACE}%{WORD:class_name}%{SPACE} (%{DATA:exceptiondetail}\n\t\n*%{GREEDYDATA:extralines})"]
      }
}

```

This is my exception stacktrace

```
20191118:15:26:23.976 [http-nio-8080-exec-24] ERROR null
ERROR|2019-11-18 15:26:23|backendorg|16CFAFCCFB14D9A3|16E7DF11C8ACFF95|16E7DF11C89AA960||null
20191118:15:26:23.983 [http-nio-8080-exec-24] ERROR java.lang.NullPointerException
	at com.abc.api.controller.SessionController.sessionAPI(SessionController.java:132)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:214)
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 19, 2019, 3:45pm UTC](https://discuss.elastic.co/t/grok-pattern-to-collect-whole-exception-stacktrace/208295/2 "2019-11-19T15:45:11Z")

</div>

If you are using a file input use a multiline codec on an input. The documentation has an example of merging lines from a stacktrace.

If you are using filebeat do the multiline processing in the beat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2019, 3:45pm UTC](https://discuss.elastic.co/t/grok-pattern-to-collect-whole-exception-stacktrace/208295/3 "2019-12-17T15:45:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.