# Java log Parsing with Filebeat and Logstash

**URL:** <https://discuss.elastic.co/t/java-log-parsing-with-filebeat-and-logstash/366280>\
**Category:** Elasticsearch\
**Created:** [September 10, 2024, 3:25am UTC](https://discuss.elastic.co/t/java-log-parsing-with-filebeat-and-logstash/366280 "2024-09-10T03:25:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [September 10, 2024, 3:25am UTC](https://discuss.elastic.co/t/java-log-parsing-with-filebeat-and-logstash/366280/1 "2024-09-10T03:25:29Z")

</div>

So I have a java log that I want to consume using filebeat. When I test in the local env I succeed, but when I try to use the production env the log is not successfully parsed. Because in the local env I use logstash but in the production env I use filebeat.

Here is an example of the log

```auto
[9/6/24 10:10:57:038 WIB] 00055cd2 SystemOut O 2024-09-06 10:10:57 HTransaction [ERROR] com.m24.shared.exception.UnsafeSessionCloseException: This not Valid Transaction
com.m24.shared.exception.UnsafeSessionCloseException: This not Valid Transaction
	at com.m24.shared.plugin.db.hibernate.HTransaction.released(HTransaction.java:54)
	at com.m24.shared.plugin.db.hibernate.HSession.close(HSession.java:113)
	at com.m24.front.ui.channeling.BayarAngsuranSyariahScreen.doPayment(BayarAngsuranSyariahScreen.java:1211)
	at com.m24.front.ui.channeling.BayarAngsuranSyariahScreen.doSave(BayarAngsuranSyariahScreen.java:498)
	at com.m24.front.ui.channeling.BayarAngsuranSyariahScreen$6$1.onClose(BayarAngsuranSyariahScreen.java:295)
	at org.vaadin.dialogs.DefaultConfirmDialogFactory$2.buttonClick(DefaultConfirmDialogFactory.java:152)

```

Logs that are successfully parsed to alstic are only

```auto
[9/6/24 10:10:57:038 WIB] 00055cd2 SystemOut O 2024-09-06 10:10:57 HTransaction [ERROR] com.m24.shared.exception.UnsafeSessionCloseException: This not Valid Transaction
com.m24.shared.exception.UnsafeSessionCloseException: This not Valid Transaction

```

When message have tag the java message is not include.  
ex:  
`	at org.vaadin.dialogs.DefaultConfirmDialogFactory$2.buttonClick(DefaultConfirmDialogFactory.java:152)`

This configuration Logstash and Filebeat:  
My Logstash in Local Env:

> type: filestream  
> id: Convert  
> enabled: true  
> paths:  
> - Convertnode1\*/SystemOut.log  
> - Convertnode2\*/SystemErr.log  
> fields:  
> application\_name: convert  
> serverName: convert-currency  
> fields\_under\_root: true  
> multiline.pattern: '^/'  
> multiline.negate: true  
> multiline.match: after

Logstash

> file {  
> path =\> "/var/log/logstash/dump\_hasil/\*.log"  
> start\_position =\> "beginning"  
> sincedb\_path =\> "/dev/null"  
> codec =\> multiline {  
> pattern =\> "\d{4}-\d{2}-\d{2}-\d{2}.\d{2}.\d{2}.\d{6}+\d{3}"  
> negate =\> true  
> what =\> "previous"

Please help

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 10, 2024, 3:50am UTC](https://discuss.elastic.co/t/java-log-parsing-with-filebeat-and-logstash/366280/2 "2024-09-10T03:50:47Z")

</div>

What version of filebeat ...

Looks like you are using filestream input so your multiline syntax is wrong , not using the `parsers` syntax see here and you would still need the correct pattern...

> **[Manage multiline messages | Filebeat Reference \[8.15\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html)**

Example...

```auto
parsers:
- multiline:
    type: pattern
    pattern: '^\['
    negate: true
    match: after

```

---

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [September 10, 2024, 4:17am UTC](https://discuss.elastic.co/t/java-log-parsing-with-filebeat-and-logstash/366280/3 "2024-09-10T04:17:46Z")

</div>

Thank you it's work now