Logstash is not parsing the my full stack trace. The stack trace is parsing but only part is coming of stack trace as full stack trace is delayed.
Can you please add some context? For example, it would be useful to see an example of the stack trace that you are trying to import, and the Logstash configuration that you are using to do so.
{"timestamp":"2019-11-19 15:42:35.891","level":"ERROR","thread":"http-nio-8080-exec-7","mdc":{"appVersion":null,"appType":null,"User-Agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0","ipAddress":"127.0.0.1","member":"1","BuildVersion":null,"queryString":"id=736145632145","uri":"/register/needDetail","HostName":"urbanpro-Vostro-3583","vistorId":"a94b99a1-6707-4865-810b-534b4d95bc68"},"logger":"org.grails.web.errors.GrailsExceptionResolver","message":"NullPointerException occurred when processing request: [GET] /register/needDetail - parameters:\nid: 736145632145\nNo enquiry found. Stacktrace follows:","context":"default","exception":"java.lang.reflect.InvocationTargetException: null\n\tat org.grails.core.DefaultGrailsControllerClass$ReflectionInvoker.invoke(DefaultGrailsControllerClass.java:210)\n\tat org.grails.core.DefaultGrailsControllerClass.invoke(DefaultGrailsControllerClass.java:187)\n\tat org.grails.web.mapping.mvc.UrlMappingsInfoHandlerAdapter.handle(UrlMappingsInfoHandlerAdapter.groovy:90)\n\tat org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963)\n\tat org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897)\n\tat org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)\n\tat org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861)\n\tat org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)\n\tat grails.plugin.springsecurity.rest.RestLogoutFilter.doFilter(RestLogoutFilter.groovy:80)\n\tat org.springframework.boot.web.filter.ApplicationContextHeaderFilter.doFilterInternal(ApplicationContextHeaderFilter.java:55)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317)\n\tat org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)\n\tat org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:115)\n\tat grails.plugin.springsecurity.web.UpdateRequestContextHolderExceptionTranslationFilter.doFilter(UpdateRequestContextHolderExceptionTranslationFilter.groovy:64)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter.doFilter(GrailsAnonymousAuthenticationFilter.groovy:53)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:158)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat grails.plugin.springsecurity.rest.RestAuthenticationFilter.doFilter(RestAuthenticationFilter.groovy:143)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.groovy:62)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat grails.plugin.springsecurity.web.SecurityRequestHolderFilter.doFilter(SecurityRequestHolderFilter.groovy:58)\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)\n\tat org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)\n\tat org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)\n\tat org.grails.web.filters.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:67)\n\tat com.mks.filters.ResponseCacheFilter.doFilter(ResponseCacheFilter.java:483)\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\tat java.lang.Thread.run(Thread.java:748)\nCaused by: java.lang.NullPointerException: No enquiry found\n\tat com.mks.util.AssertUtil.assertNotNull(AssertUtil.groovy:10)\n\tat RegisterController$_closure157.doCall(RegisterController.groovy:7737)\n\t... 41 common frames omitted\n"}
this is the configration:
`input{
file{
path => "FILENAME"
start_position => beginning
}
}
filter {
json { source =>"message"
target => "log"
}
}
output{
loggly{
key => "loggly_token"
tag => "logstash"
}
}`
And what are you seeing as output in Loggly? You said that you are getting only "part of" your stack trace. Can you show us the result of the parsing of the example that you posted?
Only limited stack trace:
{"timestamp":"2019-11-19 15:42:35.877","level":"ERROR","thread":"http-nio-8080-exec-7","mdc":{"appVersion":null,"appType":null,"User-Agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0","ipAddress":"127.0.0.1","member":"1","BuildVersion":null,"queryString":"id=736145632145","uri":"/register/needDetail","HostName":"urbanpro-Vostro-3583","vistorId":"a94b99a1-6707-4865-810b-534b4d95bc68"},"logger":"StackTrace","message":"Full Stack Trace:","context":"default","exception":"java.lang.reflect.InvocationTargetException: null\n\tat sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\n\tat sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\n\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n\tat java.lang.reflect.Method.invoke(Method.java:498)\n\tat org.springsource.loaded.ri.ReflectiveInterceptor.jlrMethodInvoke(ReflectiveInterceptor.java:1426)\n\tat org.grails.core.DefaultGrailsControllerClass$ReflectionInvok
Assuming UTF-8 encoding, your original payload is 5,490 bytes, and the output your are seeing in Loggly is truncated at exactly 1,024 bytes. It looks like something is truncating your message at 1KB.
Which version of Logstash are you using?
Meanwhile, try changing your configuration in this way, and see if it changes something:
input {
file {
path => "FILENAME"
start_position => beginning
codec => "json"
}
}
output {
loggly {
key => "loggly_token"
tag => "logstash"
}
}
Using the json filter is not necessary, if you provide a codec to the file input. This will leave your payload in the message field, and it will be shipped to Loggly in this way.
logstash-7.4.2
I can't find any specific Logstash configuration that would truncate data at 1,024 bytes. Are you sure this is not happening on the Loggly side? Can you check if there is a specific configuration on the Loggly side that cuts documents longer than 1,024 bytes?
Did you try using codec => "json" instead of the json filter? Does it change anything?
Thanks that worked
What was the problem anyways?
If that worked, the problem was probably in the json filter; I cannot find anything in the documentation that points to the filter truncating data longer than 1,024 bytes.
In any case, happy to help!
Thank you very much!
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.