Hello,
I'm trying to configure a multiline pattern to get any exceptions in my application logs, unfortunately I haven't been able yet to find a good pattern.
Sample logs
2020-09-08 13:24:13.406 INFO 17739 --- [ ] c.o.insights.queries.QueryBuilder : builder with query took 9199 ms, adding missing items and sorting took 0 ms, total results 16
2020-09-08 13:24:13.412 INFO 17739 --- [ ] c.o.insights.queries.QueryBuilder : builder with query took 9204 ms, adding missing items and sorting took 1 ms, total results 16
2020-09-08 13:24:13.413 INFO 17739 --- [fa5f52a422c550c6 136.243.153.4 username] c.o.i.services.AggregatedResultsService : Received 56 results from the queryBuilder to convert to AggregatedChannelResults
2020-09-08 13:24:13.413 INFO 17739 --- [fa5f52a422c550c6 136.243.153.4 username] c.o.i.controllers.ChannelController : returning 56 channels
2020-09-08 13:24:13.416 ERROR 17739 --- [fa5f52a422c550c6 136.243.153.4 username] c.o.i.c.e.CustomRestExceptionHandler : error occurred
org.apache.catalina.connector.ClientAbortException: java.io.IOException: Broken pipe
at org.apache.catalina.connector.OutputBuffer.doFlush(OutputBuffer.java:299)
at org.apache.catalina.connector.OutputBuffer.flush(OutputBuffer.java:262)
at org.apache.catalina.connector.CoyoteOutputStream.flush(CoyoteOutputStream.java:118)
at org.springframework.security.web.util.OnCommittedResponseWrapper$SaveContext
2020-09-08 13:49:41.887 ERROR 1531 --- [659da38bae4e106f 2001:1c04:4807:f500:1084:70cc:970c:f492 username] c.o.insights.controllers.UserController : update.phoneNumber: Phone number can only contain numbers.
javax.validation.ConstraintViolationException: update.phoneNumber: Phone number can only contain numbers.
at org.springframework.validation.beanvalidation.MethodValidationInterceptor.invoke(MethodValidationInterceptor.java:116)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecuri
My configuration :
- type: log
paths:
- /var/log/insights*.log
scan_frequency: 60s
multiline.type: pattern
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3} (ERROR*)'
multiline.negate: false
multiline.match: before
multiline.max_lines: 50
I have already tried different combinations for the negate/match configs, but it didn't help. Basically I want to have for example, the next 50 lines once there is a ERROR message, I'm able to get the first line, for example below, but not the following lines.
2020-09-08 13:49:41.887 ERROR 1531 --- [659da38bae4e106f 2001:1c04:4807:f500:1084:70cc:970c:f492 username] c.o.insights.controllers.UserController : update.phoneNumber: Phone number can only contain numbers.
I think I cannot really apply a different pattern such as "caused by" because sometimes we do have errors, but not the "Caused by"
Could someone please advise ?
Thanks in advance.