How to collect multiline java stack traces from docker container stout

[JocelynFloresz (DaChen)]

Commonly I can use the below pattern to collect logs from multiline.

    multiline.pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^Caused by:'
    multiline.negate: false
    multiline.match: after

But in my use case, my server runs in docker, and I start filebeat to collect log form docker container stout, such as

{"log":"2023-02-02 09:48:39.176 ERROR 1 --- [19094-thread-28] c.x.z.w.c.s.c.h.HttpClient               : Connect to rivers-uat.xsyxsc.cn:80 [rivers-uat.xsyxsc.cn/10.255.17.1] failed: connect timed out\n","stream":"stdout","time":"2023-02-02T01:48:39.184841549Z"}
{"log":"\n","stream":"stdout","time":"2023-02-02T01:48:39.18489938Z"}
{"log":"org.apache.http.conn.ConnectTimeoutException: Connect to rivers-uat.xsyxsc.cn:80 [rivers-uat.xsyxsc.cn/10.255.17.1] failed: connect timed out\n","stream":"stdout","time":"2023-02-02T01:48:39.18490839Z"}
{"log":"\u0009at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184916366Z"}
{"log":"\u0009at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184923779Z"}
{"log":"\u0009at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184959016Z"}
{"log":"\u0009at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.18496622Z"}
{"log":"\u0009at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184972766Z"}
{"log":"\u0009at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184979642Z"}
{"log":"\u0009at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184986456Z"}
{"log":"\u0009at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184992892Z"}
{"log":"\u0009at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184999511Z"}
{"log":"\u0009at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.185005922Z"}
{"log":"\u0009at com.xsyx.zhwl.wcs.connection.service.common.http.HttpClientService.sendHttpPostRequest(HttpClientService.java:137) ~[xsyx-zhwl-wcs-connection-service-common-1.0.0-SNAPSHOT.jar!/:1.0.0-SNAPSHOT]\n","stream":"stdout","time":"2023-02-02T01:48:39.185012912Z"}

I'm wondering what pattern can i use to collect multiline log in the use case?

[Ayush_Mathur]

Hello @JocelynFloresz , welcome to the community !
I believe you can refer to filebeat documentation on multiline log parsing here: Manage multiline messages | Filebeat Reference [8.6] | Elastic
In particular, since you already have a skeleton of pattern, I guess you can use the playground to tweak and test the pattern: Go Playground - The Go Programming Language

[JocelynFloresz (DaChen)]

thanks