# Matching a field (exception name) on the second line in a multiline event

**URL:** <https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016>\
**Category:** Logstash\
**Created:** [January 25, 2016, 11:25am UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016 "2016-01-25T11:25:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ilhami\_Visne](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@Ilhami\_Visne](https://discuss.elastic.co/u/Ilhami_Visne)\
**Post date:** [January 25, 2016, 11:25am UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016/1 "2016-01-25T11:25:02Z")

</div>

I have multiline Log4J logs. The lines after the first are optional. The first line contains the log message and after that is the stacktrace. I want to extract the top exception class name on a stacktrace and it is the first part on the second line. An example:

```
2016-01-18 13:19:34,812 [myScheduler-4] ERROR com.company.framework.service.notification.TriggerServiceImpl- Hibernate operation: could not load an entity: [com.company.framework.pojo.jc3iedm.ReportingData#32300000000000565988];.
java.sql.SQLException: Connection has already been closed.
	at org.apache.tomcat.jdbc.pool.ProxyConnection.invoke(ProxyConnection.java:118)
	at com.sun.proxy.$Proxy47.prepareStatement(Unknown Source)
	at org.hibernate.jdbc.AbstractBatcher.getPreparedStatement(AbstractBatcher.java:534)

```

I'm interested on the 'java.sql.SQLException' part. I wrote the following grok pattern:

```
LOG4J_DATESTAMP %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND})
LOG4J_LOG %{LOG4J_DATESTAMP:timestamp} \[%{GREEDYDATA:thread}\] {LOGLEVEL:level} %{JAVACLASS:class}\-%{SPACE}%{JAVALOGMESSAGE:logmessage}%{SPACE}(^%{JAVACLASS:exception})?

```

**(^%{JAVACLASS:exception})?** is the part, which should match the next line. It matches as expected on the [grokconstructor.appspot.com](http://grokconstructor.appspot.com) but i can't get it working with the logstash 2.1.1 version. All other fields are extracted successfully.

This is the logstash conf file:

```
input {
 file {
	path => "D:/projects/ELK/localhost.log"
	start_position => beginning
	codec => multiline {
	  patterns_dir => "../patterns"
      pattern => "^%{LOG4J_DATESTAMP}"
      negate => true
      what => "previous"
    }
 }
}

filter {
 grok {
    match => { "message" => "%{LOG4J_LOG}"}
 }
}

output { 
  elasticsearch { }
}

```

My guess is that logmessage ( `JAVALOGMESSAGE (.*)` ) matches everything up to the end and therefore there is nothing left to match. But my questions are how is it working on the [grokconstructor.appspot.com](http://grokconstructor.appspot.com)? and how to achieve this with logstash?

thanks.  
ilhami

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 25, 2016, 11:51am UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016/2 "2016-01-25T11:51:53Z")

</div>

I suspect you have to start the regexp with `(?m)` so that newline characters don't count as the end of the string.

---

<div class="post-metadata">

**Author:** ![Ilhami\_Visne](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@Ilhami\_Visne](https://discuss.elastic.co/u/Ilhami_Visne)\
**Post date:** [January 25, 2016, 12:12pm UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016/3 "2016-01-25T12:12:57Z")

</div>

i think `(?m)` does just the opposite. Via this mode, dot (.) starts to match the newline too. See this please [https://logstash.jira.com/browse/LOGSTASH-1097](https://logstash.jira.com/browse/LOGSTASH-1097)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 25, 2016, 12:18pm UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016/4 "2016-01-25T12:18:12Z")

</div>

Ah, I didn't see that you were trying to use `^` to match the beginning of the next line. In that case I don't know.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016/5 "2017-07-06T05:14:27Z")

</div>