# How may I get only ERROR related logs from my stack trace?

**URL:** <https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329>\
**Category:** Logstash\
**Created:** [August 14, 2018, 10:45am UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329 "2018-08-14T10:45:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vyankatesh\_S\_Repal](https://avatars.discourse-cdn.com/v4/letter/v/c77e96/32.png) [@Vyankatesh\_S\_Repal](https://discuss.elastic.co/u/Vyankatesh_S_Repal)\
**Post date:** [August 14, 2018, 10:45am UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329/1 "2018-08-14T10:45:05Z")

</div>

Currently I am developing an application where I need to retrieve only "ERROR" related logs and put them to elasticsearch index.

Here is my sample log:

```
2018-07-05 19:37:15,888 [6] ERROR <Description> - Error while ProcessRequest, Level: ERROR

```

I am bit confused about this. Should I use particular grok pattern in filter or I can handle this in input itself?

This is my current logstash pipeline configuration:

```
           input{
                    file{
                    path => "D:\ELK_Info\APEXDataService.log"
                    start_position => "beginning"
                    codec => multiline {
                          pattern => "^%{TIMESTAMP_ISO8601} "
                          negate => true
                          what => previous
                        }
                    }
                    }

    output {
    if[LEVEL] == "ERROR"
      http {
        url => "http://localhost:9200/indexName/log"
        http_method => "post"
        format => "json"
      }
    }

```

I have added multi line codec in my input.  
So my question is, how may I filter this to get all the data of my log related to ERROR to my output?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 14, 2018, 5:34pm UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329/2 "2018-08-14T17:34:24Z")

</div>

You need to use a filter (grok or dissect) to extract the loglevel into a field of its own. Once that's done a conditional like

```
if[LEVEL] == "ERROR"

```

will work.

> So my question is, how may I filter this to get all the data of my log related to ERROR to my output?

Your multiline configuration looks fine. I find it very hard to believe that Logstash only includes the lines up to "End of stack trace ..." in an event it produces.

Why are you using an http output to post to Elasticsearch?

---

<div class="post-metadata">

**Author:** ![Vyankatesh\_S\_Repal](https://avatars.discourse-cdn.com/v4/letter/v/c77e96/32.png) [@Vyankatesh\_S\_Repal](https://discuss.elastic.co/u/Vyankatesh_S_Repal)\
**Post date:** [August 16, 2018, 12:26pm UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329/3 "2018-08-16T12:26:29Z")

</div>

Thanks for your suggestion, will try to implement the same.

---

<div class="post-metadata">

**Author:** ![Vyankatesh\_S\_Repal](https://avatars.discourse-cdn.com/v4/letter/v/c77e96/32.png) [@Vyankatesh\_S\_Repal](https://discuss.elastic.co/u/Vyankatesh_S_Repal)\
**Post date:** [August 20, 2018, 5:20am UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329/4 "2018-08-20T05:20:24Z")

</div>

By the way, I want to create a document under a particular index and that's why I am sending the output to HTTP?  
You can let me know how may I improve this.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 7:11am UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329/5 "2018-08-20T07:11:31Z")

</div>

> By the way, I want to create a document under a particular index and that's why I am sending the output to HTTP?

The elasticsearch output plugin has configuration options for choosing the index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2018, 7:11am UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329/6 "2018-09-17T07:11:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.