# JAVALOGMESSAGE takes it all

**URL:** <https://discuss.elastic.co/t/javalogmessage-takes-it-all/87780>\
**Category:** Logstash\
**Created:** [May 31, 2017, 3:54pm UTC](https://discuss.elastic.co/t/javalogmessage-takes-it-all/87780 "2017-05-31T15:54:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![remi128](https://avatars.discourse-cdn.com/v4/letter/r/ecb155/32.png) [@remi128](https://discuss.elastic.co/u/remi128)\
**Post date:** [May 31, 2017, 3:54pm UTC](https://discuss.elastic.co/t/javalogmessage-takes-it-all/87780/1 "2017-05-31T15:54:21Z")

</div>

i am starting to analyze logs with filebeat and logstash. Inside the grok definition i am using JAVALOGMESSAGE to extract the pure message. From my understanding the pattern "(.\*)" should mean something like "take any character but not a line break"  
But when i let it run on a log entry, where an exception is contained, it returns the message AND the complete exception AND the complete stack trace, although i can see the \n in the message text.

In filebeat the multiline option is activated.  
What am i doing wrong here?

Here is my logstash config:

```
input {
beats {
    port => "5045"
}
}

 filter {
   grok {
    	break_on_match => false
    	match => ["message", "(?<timestamp>%{TIMESTAMP_ISO8601}) (?<log_level>%{LOGLEVEL}) (?<logger_name>%{LOGGER}) - (?<log_message>%{JAVALOGMESSAGE})"]
  }
date{
match => ["timestamp_string", "ISO8601"]
    remove_field => ["timestamp_string"]
  }
}

output {
stdout { codec => rubydebug }
  # elasticsearch { hosts => ["localhost:9200"] }
}
```

---

<div class="post-metadata">

**Author:** ![remi128](https://avatars.discourse-cdn.com/v4/letter/r/ecb155/32.png) [@remi128](https://discuss.elastic.co/u/remi128)\
**Post date:** [June 1, 2017, 4:10pm UTC](https://discuss.elastic.co/t/javalogmessage-takes-it-all/87780/2 "2017-06-01T16:10:39Z")

</div>

reply by myself. I let the JAVALOGMESSAGE now and added a "manual" configuration like that:

```
	match => ["message", "(?<timestamp>%{TIMESTAMP_ISO8601})%{SPACING}(?<log_level>%{LOGLEVEL})%{SPACING}(?<logger_name>%{LOGGER})%{SPACING}-%{SPACING}(?<log_message>[a-zA-Z$_0-9 \S]*)%{SPACING}(?<exceptionComplete>%{GREEDYDATA})" ]

```

And this is doing what i want. I probably forgot some characters inside the log\_message declaration, but this i will add later on.

I still do not understand, why "(.\*)" is not working like wished.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2017, 4:10pm UTC](https://discuss.elastic.co/t/javalogmessage-takes-it-all/87780/3 "2017-06-29T16:10:45Z")

</div>

Closed on June 29, 2017, 4:10pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.