Jenkins server log tracking in logstash

I'm setting up elasticsearch suite for the first time. I managed to log the syslog files.
Now, trying to source Jenkins server log file.
In Jenkins server log, not every line is printed with the date. For example, it is like below

 Aug 06, 2018 6:49:18 AM hudson.slaves.RetentionStrategy$Demand check
INFO: Disconnecting computer XXX as it has been idle for 3 days 22 hr
Aug 06, 2018 6:49:41 AM hudson.model.AsyncPeriodicWork doRun
INFO: CloudBees DevOptics Deliver event queues thread is still running. Execution aborted.
Aug 7, 2018 6:49:18 AM hudson.slaves.RetentionStrategy$Demand check
INFO: Disconnecting computer YYY as it has been idle for 2 days
Aug 27, 2018 7:04:31 AM handleUnknownChannelRequest
WARNING: handleUnknownChannelRequest(ChannelExec[id=4, recipient=0]-ClientSessionImpl[user@/IP:22]) Unknown channel request:[want-reply=true]
Aug 27, 2018 4:30:00 PM hudson.XmlFile replaceIfNotAtTopLevel
WARNING: JENKINS-45892: reference to 
hudson.model.FreeStyleProject@26ba567c[jobname] being saved from unexpected /var/lib/jenkins/jobs/job1.xml
    at hudson.XmlFile.replaceIfNotAtTopLevel(
    at hudson.model.AbstractItem.writeReplace(
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(
    at java.lang.reflect.Method.invoke(
    at com.thoughtworks.xstream.converters.reflection.SerializationMethodInvoker.callWriteReplace(
    at hudson.util.RobustReflectionConverter.marshal(
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(

Has anyone tried passing Jenkins server logs to logstash ? Could you please provide a sample config file ?

Use a multiline codec (or the equivalent if you're using Filebeat) to join the lines of multiline messages into a single Logstash event. Once you're there the message can be parsed with a fairly regular grok filter.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.