Conf -
input
{
file
{
path => "C:/MyLogs/*"
#start_position => "beginning"
}
}
filter
{
grok
{
match =>
{
"message" =>
[
"ProviderId : %{UUID:SessionID}",
"EventId : %{NUMBER:EventId}",
"Payload : [sessionID : %{UUID:SessionID}] [type : %{WORD:ExceptionType}] [data : %{DATA:Data}] [innerException : %{DATA:InnerException}] [message : %{DATA:ExceptionMessage}] [source : %{DATA:ExceptionSource}] [stackTrace : (?(.|\r|\n)*)]",
"EventName : %{WORD:EventName}",
"ProcessId : %{NUMBER:ProcessId}",
"ThreadId : %{NUMBER:ThreadId}"
]
}
}
mutate
{
add_field => { "Type" => "ApiExceptionEventSource" }
rename => { "path" => "Path" }
rename => { "host" => "Host" }
}
}
output
{
stdout
{
codec => rubydebug
}
}
Log Pattern -
ProviderId : 46875d78-3924-5303-f49e-65b8bc0dc289
EventId : 11
Payload : [sessionID : 19c6fd3f-79d5-406a-9d93-f1ada6bc6fde] [type : InvalidMethodArgumentException] [data : ] [innerException : ExceptionMessage] [message : The CallID field is required.] [source : MySol.Services.Common] [stackTrace : at MySol.Services.Common.Entities.Database.BaseEFService1.<SaveAsync>d__0.MoveNext() in e:\Builds\15\IR\Main.QA\src\WebServiceSln\MySol.Services.Common\Entities\Database\BaseEFService.cs:line 101 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at MySol.Services.Common.Entities.Database.BaseEFCreateService3.d__3.MoveNext() in e:\Builds\15\IR\Main.QA\src\WebServiceSln\MySol.Services.Common\Entities\Database\BaseEFCreateService.cs:line 47
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at MySol.API.Common.MessageHandlers.CreateIRRRequestHeadersMessageHandler.d__0.MoveNext() in e:\Builds\15\IR\Main.QA\src\WebServiceSln\MySol.API.Common\MessageHandlers\CreateIRRRequestHeadersMessageHandler.cs:line 58] [targetSite : Void MoveNext()]
EventName : ResponseInfo
ProcessId : 21096
ThreadId : 12336