# How to collect multiline java stack traces from docker container stout

**URL:** <https://discuss.elastic.co/t/how-to-collect-multiline-java-stack-traces-from-docker-container-stout/324497>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [February 2, 2023, 3:29am UTC](https://discuss.elastic.co/t/how-to-collect-multiline-java-stack-traces-from-docker-container-stout/324497 "2023-02-02T03:29:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JocelynFloresz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jocelynfloresz/32/116571_2.png) [@JocelynFloresz](https://discuss.elastic.co/u/JocelynFloresz)\
**Post date:** [February 2, 2023, 3:29am UTC](https://discuss.elastic.co/t/how-to-collect-multiline-java-stack-traces-from-docker-container-stout/324497/1 "2023-02-02T03:29:03Z")

</div>

Commonly I can use the below pattern to collect logs from multiline.

```auto
    multiline.pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^Caused by:'
    multiline.negate: false
    multiline.match: after

```

But in my use case, my server runs in docker, and I start filebeat to collect log form docker container stout, such as

```auto
{"log":"2023-02-02 09:48:39.176 ERROR 1 --- [19094-thread-28] c.x.z.w.c.s.c.h.HttpClient : Connect to rivers-uat.xsyxsc.cn:80 [rivers-uat.xsyxsc.cn/10.255.17.1] failed: connect timed out\n","stream":"stdout","time":"2023-02-02T01:48:39.184841549Z"}
{"log":"\n","stream":"stdout","time":"2023-02-02T01:48:39.18489938Z"}
{"log":"org.apache.http.conn.ConnectTimeoutException: Connect to rivers-uat.xsyxsc.cn:80 [rivers-uat.xsyxsc.cn/10.255.17.1] failed: connect timed out\n","stream":"stdout","time":"2023-02-02T01:48:39.18490839Z"}
{"log":"\u0009at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184916366Z"}
{"log":"\u0009at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184923779Z"}
{"log":"\u0009at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184959016Z"}
{"log":"\u0009at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.18496622Z"}
{"log":"\u0009at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184972766Z"}
{"log":"\u0009at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184979642Z"}
{"log":"\u0009at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184986456Z"}
{"log":"\u0009at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184992892Z"}
{"log":"\u0009at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.184999511Z"}
{"log":"\u0009at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.13.jar!/:4.5.13]\n","stream":"stdout","time":"2023-02-02T01:48:39.185005922Z"}
{"log":"\u0009at com.xsyx.zhwl.wcs.connection.service.common.http.HttpClientService.sendHttpPostRequest(HttpClientService.java:137) ~[xsyx-zhwl-wcs-connection-service-common-1.0.0-SNAPSHOT.jar!/:1.0.0-SNAPSHOT]\n","stream":"stdout","time":"2023-02-02T01:48:39.185012912Z"}

```

I'm wondering what pattern can i use to collect multiline log in the use case?

---

<div class="post-metadata">

**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Post date:** [February 2, 2023, 7:33am UTC](https://discuss.elastic.co/t/how-to-collect-multiline-java-stack-traces-from-docker-container-stout/324497/2 "2023-02-02T07:33:51Z")

</div>

Hello @JocelynFloresz , welcome to the community !  
I believe you can refer to filebeat documentation on multiline log parsing here: [Manage multiline messages | Filebeat Reference [8.6] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)  
In particular, since you already have a skeleton of pattern, I guess you can use the playground to tweak and test the pattern: [Go Playground - The Go Programming Language](https://go.dev/play/p/uAd5XHxscu)

---

<div class="post-metadata">

**Author:** ![JocelynFloresz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jocelynfloresz/32/116571_2.png) [@JocelynFloresz](https://discuss.elastic.co/u/JocelynFloresz)\
**Post date:** [February 3, 2023, 3:21am UTC](https://discuss.elastic.co/t/how-to-collect-multiline-java-stack-traces-from-docker-container-stout/324497/3 "2023-02-03T03:21:09Z")

</div>

thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2023, 5:22am UTC](https://discuss.elastic.co/t/how-to-collect-multiline-java-stack-traces-from-docker-container-stout/324497/4 "2023-03-03T05:22:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.