Logstash : Codec multiline problem

Elastic Stack Logstash
1

Each time logstash try to parse a log like this :

09-Mar-2023 16:45:40.861 SEVERE [main] org.apache.catalina.core.StandardContext.listenerStart Exception sending context initialized event to listener instance of class [eu.europa.ec.empl.eures.web.servlet.ApplicationContextListener]
	org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'propertyConfigurer' defined in class eu.europa.ec.empl.eures.portal.spring.config.PortalPropertiesConfig: Unsatisfied dependency expressed through constructor argument with index 0 of type [java.util.Properties]: : Error creating bean with name 'propertiesFactoryBean' defined in class eu.europa.ec.empl.eures.portal.spring.config.PortalPropertiesConfig: Invocation of init method failed; nested exception is java.io.FileNotFoundException: http://eures-config:8080/eures/eures-config/page/configuration/PORTAL?appId=PORTAL; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'propertiesFactoryBean' defined in class eu.europa.ec.empl.eures.portal.spring.config.PortalPropertiesConfig: Invocation of init method failed; nested exception is java.io.FileNotFoundException: http://eures-config:8080/eures/eures-config/page/configuration/PORTAL?appId=PORTAL
Related cause: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'portalDataSource' defined in class path resource [eures-portal-core.xml]: Invocation of init method failed; nested exception is javax.naming.NameNotFoundException: Name [${portal.db.datasource.jndiDataSource.name}] is not bound in this Context. Unable to find [${portal.db.datasource.jndiDataSource.name}].
Related cause: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'euresDbJndiDataSource' defined in class path resource [eures-portal-core.xml]: Invocation of init method failed; nested exception is javax.naming.NameNotFoundException: Name [${eures.db.datasource.jndiDataSource.name}] is not bound in this Context. Unable to find [${eures.db.datasource.jndiDataSource.name}].
Related cause: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jndiDataSource' defined in class path resource [eures-portal-core.xml]: Invocation of init method failed; nested exception is javax.naming.NameNotFoundException: Name [${portal.db.datasource.jndiDataSource.name}] is not bound in this Context. Unable to find [${portal.db.datasource.jndiDataSource.name}].

I get this error :

[2023-04-26T09:09:38,786][WARN ][logstash.outputs.elasticsearch][main][c910e52747f06eb8a4642bd5576e39083ed54d4c7a08ffa63b55cc966c085b12] Could not index event to Elasticsearch. status: 400, action                     : ["index", {:_id=>nil, :_index=>"test_index2", :routing=>nil}, {"log"=>{"file"=>{"path"=>"/var/log/all_logs/eures-portal/serverlogs/localhost.2023-03-09.log"}}, "type"=>"localhost", "@version"=>"                     1", "host"=>{"name"=>"cb1d273ab15b"}, "@timestamp"=>2023-04-26T09:09:36.090190595Z, "time"=>"%{day_localhost}-%{month_localhost}-%{year_localhost} %{time_localhost}", "message"=>"\t\tat org.spring                     framework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482)\n\t\tat org.springframework.beans.factory.support.AbstractBeanFactory$1.g

The problem is from the date parsing, but that's because the logs is split in two part :

09-Mar-2023 16:45:40.861 SEVERE [main] org.apache.catalina.core.StandardContext.listenerStart Exception sending context initialized event to listener instance of class [eu.europa.ec.empl.eures.web.servlet.ApplicationContextListener]

and

org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'propertyConfigurer' defined in class eu.europa.ec.empl.eures.portal.spring.config.PortalPropertiesConfig: Unsatisfied dependency expressed through constructor argument with index 0 of type [java.util.Properties]: : Error creating bean with name 'propertiesFactoryBean' defined in class eu.europa.ec.empl.eures.portal.spring.config.PortalPropertiesConfig: Invocation of init method failed; nested exception is java.io.FileNotFoundException: http://eures-config:8080/eures/eures-config/page/configuration/PORTAL?appId=PORTAL; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'propertiesFactoryBean' defined in class eu.europa.ec.empl.eures.portal.spring.config.PortalPropertiesConfig: Invocation of init method failed; nested exception is java.io.FileNotFoundException: http://eures-config:8080/eures/eures-config/page/configuration/PORTAL?appId=PORTAL
Related cause:

But why is the log split in two ? Is the problem from my code multiline ?

  file {
    path => "/var/log/all_logs/**/serverlogs/localhost.*.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
	codec => multiline {
	  pattern => "^\d{2}-\w{3}-\d{4}"
	  negate => true
	  what => "previous"
    }
    type => "localhost"
  }
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.