Jira Error Logging with Logstash / Filebeat

Elastic Stack Logstash
1

Howdy Folks,

Disclaimer: I am a bloody beginner at the ELK Stack.

We want log the errors and messages from our Atlassian Enviroment. Starting with Jira, we had issues with correct formats in the messages.

I already adjusted the log4j output, installed the logstash log4j plugin and send the logs with filebeat to logstash.

But, the message is still: message 2019-09-06 08:54:39,654+0000 DEBUG ActiveObjectsServiceFactory:208 - Gemini Blueprint context shutdown thread 1 [c.a.activeobjects.osgi.ActiveObjectsServiceFactory] ungetService bundle [com.atlassian.plugins.base-hipchat-integration-plugin-api]

Now I have some questions:

  • How can I set the fields correct. Like Date, Message Type, message, and other stuff?
  • How can I handle the multiline messages like java exceptions?

Hope you can help,

Dennis

2

You can parse that using a grok filter. If you have problems parsing you can adjust the log4j configuration to make it easier to parse .You can use a multiline codec to merge the lines of a stacktrace.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.