Multi-line pattern matching help

I am trying to capture the following log using multiline pattern.
If I try to capture it with date '^\d{4}-\d{2}-\d{2}' then all the logs (not multine) also get concatenated.
If I try to capture with '^[[:space:]]+|^at' then I miss the previous line which has the date and log level.

2017-06-07 00:01:22,597 ERROR org.apache.hadoop.hdfs.server.datanode.DataNode: xxx-xxxx.xxx.xxxx.com:71:DataXceiver error processing READ_BLOCK operation  src: /10.150.22.231:5921 dst: /10.150.26.22:71
java.net.SocketTimeoutException: 240000 millis timeout while waiting for channel to be ready for write. ch : java.nio.channels.SocketChannel[connected local=/10.150.26.22:71 remote=/10.150.22.231:5921]
	at org.apache.hadoop.net.SocketIOWithTimeout.waitForIO(SocketIOWithTimeout.java:246)
	at org.apache.hadoop.net.SocketOutputStream.waitForWritable(SocketOutputStream.java:172)
	at org.apache.hadoop.net.SocketOutputStream.transferToFully(SocketOutputStream.java:220)
	at org.apache.hadoop.hdfs.server.datanode.BlockSender.sendPacket(BlockSender.java:566)
	at org.apache.hadoop.hdfs.server.datanode.BlockSender.sendBlock(BlockSender.java:735)
	at org.apache.hadoop.hdfs.server.datanode.DataXceiver.readBlock(DataXceiver.java:527)
	at org.apache.hadoop.hdfs.protocol.datatransfer.Receiver.opReadBlock(Receiver.java:116)
	at org.apache.hadoop.hdfs.protocol.datatransfer.Receiver.processOp(Receiver.java:71)
	at org.apache.hadoop.hdfs.server.datanode.DataXceiver.run(DataXceiver.java:239)
	at java.lang.Thread.run(Thread.java:745)

Solved it using:

  multiline.pattern: '^\d{4}-\d{2}-\d{2}'
  multiline.negate: True
  multiline.match: after
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.