Java stack traces in example at elastic dosn't work Multiline java type log

Elastic Stack Beats
1

I have log:

2016-11-10 06:52:09.868+0000 ERROR The RuntimeException could not be mapped to a response
 java.lang.ArrayIndexOutOfBoundsException: 1
              at org.neo4j.server.rest.repr.formats.UrlFormFormat.readMap(UrlFormFormat.java:99)
              at org.neo4j.server.rest.dbms.UserService.setPassword(UserService.java:94)    
              at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethod
    DispatchProvider$ResponseOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:205)

second string start with java... following 3 lines with whitespace and at and then random line I wan to get it to logstash as a single event.
My filebeat config

multiline:
      pattern: '^[[:space:]]+|^java'
      negate: false
      match: after

with this i can achieve 2 event but i need one message last string doesn't involve

2

can anyone help me please?

3

Assuming you are using filebeat 5.0, pleae have a look here: https://www.elastic.co/guide/en/beats/filebeat/5.0/multiline-examples.html#_testing_your_regexp_pattern_for_multiline You can use this to test your own regexp against your pattern.

Please be patient when you open a question. If you need commercial support have a look at: https://www.elastic.co/subscriptions

4

thanks ruflin
but I use filebeat 1.3.1 and I've already read this article but can't sort out how to solve it completely

5

normal log lines start with year and trace never start with a digit? => Use a pattern checking for a digit pattern: '^[[:digit:]]'

1 Like
6

thanks steffens good idea i wiil try

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.