Include multiline and non-multiline events

Elastic Stack Beats
1 
 {"sub-4.0": { "level":"WARN","timestamp":"2021-02-12 13:01:25,047","thread":"Mapper","file":"filemapper.java","line":"732","message":"no data found"}}
 {"sub-4.0": { "level":"WARN","timestamp":"2021-02-12 13:01:26,047","thread":"Mapper","file":"filemapper.java","line":"732","message":"no data found"}}
{"sub-4.0": { "level":"ERROR","timestamp":"2021-02-12 13:01:26,047","thread":"Fetcher","file":"case.java","line":"732","message":"An exception occurred while acquiring a poolable resource."}}
java.sql.SQLException: The Network Adapter could not establish the connection
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:412)
    at oracle.jdbc.driver.PhysicalConnection.(PhysicalConnection.java:531)
    at oracle.jdbc.driver.T4CConnection.(T4CConnection.java:221)
    at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32)
    at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:503)
    at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:134)
    at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:182)
    at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:171)
    at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:137)
    at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1014)
    at com.mchange.v2.resourcepool.BasicResourcePool.access$800(BasicResourcePool.java:32)
    at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1810)
    at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)
Caused by: oracle.net.ns.NetException: The Network Adapter could not establish the connection
    at oracle.net.nt.ConnStrategy.execute(ConnStrategy.java:359)
    at oracle.net.resolver.AddrResolution.resolveAndExecute(AddrResolution.java:422)
    at oracle.net.ns.NSProtocol.establishConnection(NSProtocol.java:672)
    at oracle.net.ns.NSProtocol.connect(NSProtocol.java:237)
    at oracle.jdbc.driver.T4CConnection.connect(T4CConnection.java:1042)
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:301)
    ... 12 more
Caused by: java.net.ConnectException: Connection timed out: connect
    at java.net.DualStackPlainSocketImpl.waitForConnect(Native Method)
    at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
    at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
    at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
    at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
    at java.net.PlainSocketImpl.connect(Unknown Source)
    at java.net.SocksSocketImpl.connect(Unknown Source)
    at java.net.Socket.connect(Unknown Source)
    at oracle.net.nt.TcpNTAdapter.connect(TcpNTAdapter.java:141)
    at oracle.net.nt.ConnOption.connect(ConnOption.java:123)
    at oracle.net.nt.ConnStrategy.execute(ConnStrategy.java:337)
    ... 17 more
 {"sub-4.0": { "level":"WARN","timestamp":"2021-02-12 13:01:28,047","thread":"Mapper","file":"filemapper.java","line":"732","message":"no data found"}}
 {"sub-4.0": { "level":"WARN","timestamp":"2021-02-12 13:01:29,047","thread":"Mapper","file":"filemapper.java","line":"732","message":"no data found"}}

The following filebeat.yml file seems to work fine at combining the stacktrace lines and the preceding "level":"ERROR" line, but the remaining lines (1-2 and the last two lines) are being omitted.

- type: log
  enabled: true
  paths:
    - /logs/service.log

  multiline:
    pattern: '^[[:space:]]*{'
    negate: true
    match: after

  processors:
  - decode_json_fields:
      when.regexp:
        message: '^[[:space:]]*{'
      fields: ["message"]
      target:

I would hope to see 5 separate entries (one for the multiline event and 4 for the non-multiline events).

Can someone suggest how I can modify the filebeat.yml to accommodate for this?

Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.