# Handle exceptions

**URL:** <https://discuss.elastic.co/t/handle-exceptions/150478>\
**Category:** Logstash\
**Created:** [September 30, 2018, 3:52pm UTC](https://discuss.elastic.co/t/handle-exceptions/150478 "2018-09-30T15:52:22Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [September 30, 2018, 3:52pm UTC](https://discuss.elastic.co/t/handle-exceptions/150478/1 "2018-09-30T15:52:22Z")

</div>

Hi all,  
I have sysout log with many exception. how to read that exceptions. Is there any better way to read the exception. I'm using gork filter to read the pattern(am successfully able to read the pattern). But I can't able to handle the exception. In the same log file i have XML response also. Kindly suggest the best way to read the log file.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [October 2, 2018, 10:04am UTC](https://discuss.elastic.co/t/handle-exceptions/150478/2 "2018-10-02T10:04:14Z")

</div>

No one can help you with so little information.

You need to post examples of the log lines that you are having troubles with and the config you have so far.

---

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [October 5, 2018, 5:10am UTC](https://discuss.elastic.co/t/handle-exceptions/150478/3 "2018-10-05T05:10:33Z")

</div>

Hi @guyboertje,

Thanks for the reply.

I can't upload my log file. it's 98kb. Kinldy help me.

Sample logs

```auto
[9/10/18 13:00:45:978 IST] 000002bd SystemOut O response : {
  "@count": 122,
  "@start": 1,
  "@totalcount": 122,
  "Messages": [],
  "ResourceName": "Test",
  "ReturnCode": 0,
  "content": [
    {"Test": {"header": {"TestID": "C1002660"}}},
    {"Test": {"header": {"TestID": "C1011849"}}},
    {"Test": {"header": {"TestID": "C1031425"}}},
[9/10/18 15:40:04:441 IST] 000002be SystemOut O isUserPresentAndValid: true
[9/10/18 15:40:04:449 IST] 000002be SystemOut O <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<CountList>
    <ProCode>MA2014</ProCode>
    <Actcode>000</Actcode>
    <ApplicationName>Test1</ApplicationName>
    <UserId>15497845</UserId>
    <NoOfDays>30</NoOfDays>
    <Count></Count>
</CountList>

[9/10/18 15:40:04:467 IST] 000002be SystemOut O 
[9/10/18 15:40:04:474 IST] 000002be SystemOut O <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<CountList>
    <ProCode>MA2014</ProCode>
    <Actcode>000</Actcode>
    <ApplicationName>Test2</ApplicationName>
    <UserId>15497845</UserId>
    <NoOfDays>30</NoOfDays>
    <Count></Count>
</CountList>

```

---

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [October 5, 2018, 5:11am UTC](https://discuss.elastic.co/t/handle-exceptions/150478/4 "2018-10-05T05:11:53Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44251ffb8f4af7e9228694f48e5aa491481ebc73.png)

---

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [October 9, 2018, 12:19pm UTC](https://discuss.elastic.co/t/handle-exceptions/150478/5 "2018-10-09T12:19:50Z")

</div>

Anybody can help me??

---

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [October 9, 2018, 12:43pm UTC](https://discuss.elastic.co/t/handle-exceptions/150478/6 "2018-10-09T12:43:20Z")

</div>

once try this and create separate file at the output to identify the exception

output {  
file { path =\> ...  
codec =\> line {  
format =\> "custom format: %{message}"}  
}  
}

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [October 17, 2018, 11:27am UTC](https://discuss.elastic.co/t/handle-exceptions/150478/7 "2018-10-17T11:27:17Z")

</div>

Before you can begin parsing, you need to collect the multiline sections into one logical line using the LS multiline codec or the multiline feature in Filebeat. For the multiline codec use:

```auto
  pattern => "^\["
  negate => true
  what => "previous"

```

All the lines start with `[9/10/18 13:00:45:978 IST] 000002bd SystemOut O`  
You can use dissect to extract the data between the delimiters. `[,] and space(s)`

```auto
[9/10/18 13:00:45:978 IST] 000002bd SystemOut O response : {
  "@count": 122,
  "@start": 1,
  "@totalcount": 122,
  "Messages": [],
  "ResourceName": "Test",
  "ReturnCode": 0,
  "content": [
    {"Test": {"header": {"TestID": "C1002660"}}},
    {"Test": {"header": {"TestID": "C1011849"}}},
    {"Test": {"header": {"TestID": "C1031425"}}},

```

The above line looks like it contains incomplete JSON - it will not be parseable by the JSON filter. Are all such lines truncated?

```auto
[9/10/18 15:40:04:441 IST] 000002be SystemOut O isUserPresentAndValid: true

```

The above two lines have a KV pair `key: value` but the other lines don't. You will need a conditional section to apply a KV filter to those lines only.

The two lines with XML snippets in them may be able to be parsed by the XML filter.

Use this config to start the develop test cycle. Replace the `message` string in the generator input with more complicated source strings as you add filters and conditionals.

```auto
input {
  generator {
    message => "[9/10/18 15:40:04:441 IST] 000002be SystemOut O isUserPresentAndValid: true"
    count => 1
  }
}

filter {
  dissect {
    mapping => {
      message => '[%{time}] %{code} %{channel->} %{zero} %{msg}'
    }
  }
}

output { stdout { codec => rubydebug } }

```

---

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [October 19, 2018, 5:15am UTC](https://discuss.elastic.co/t/handle-exceptions/150478/8 "2018-10-19T05:15:54Z")

</div>

Thank you for your reply, I'll try and let you know the result.  
However the JSON also in a completed form only. I uploaded the sample output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2018, 5:15am UTC](https://discuss.elastic.co/t/handle-exceptions/150478/9 "2018-11-16T05:15:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.