I am using filebeats to send Atlassian catalina Logs. Below is a snippet filebeat configuration
- /opt/atlassian/jira/logs/catalina.out
fields:
log_type: catalina
log_application: atlassian_jira
multiline.pattern: '^[0-9]{2}-[[:alpha:]]{3}-[0-9]{4}'
multiline.negate: true
multiline.match: after
It works ok. But what I found was a particular entry was not completely captured
In the below log entry , entry starting "Exception in thread "com.atlassian.mywork.client.reliability.DefaultUnreliableWorker:thread-426" didnot appear in the elastic search. Instead the next log entry starting with data entry appeared.
17-Apr-2020 22:12:10.541 WARNING [http-nio-8080-exec-175] com.sun.jersey.spi.container.servlet.WebComponent.filterFormParameters A servlet request, to the URI https://jira.retailbusinessservices.com/rest/issueNav/1/issueNav/operations/tools, contains form parameters in the request body but the request body has been consumed by the servlet or a servlet filter accessing the request parameters. Only resource methods using @FormParam will work as expected. Resource methods consuming the request body by other means will not work as expected. Exception in thread "com.atlassian.mywork.client.reliability.DefaultUnreliableWorker:thread-426" java.lang.RuntimeException: com.atlassian.sal.api.net.ResponseException: 500 - at com.atlassian.mywork.client.reliability.DefaultUnreliableWorker$1$1.run(DefaultUnreliableWorker.java:81) at com.atlassian.sal.core.executor.ThreadLocalDelegateRunnable.run(ThreadLocalDelegateRunnable.java:34) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) Caused by: com.atlassian.sal.api.net.ResponseException: 500 - at com.atlassian.mywork.client.reliability.DefaultUnreliableWorker$2.handle(DefaultUnreliableWorker.java:121) at com.atlassian.mywork.client.reliability.DefaultUnreliableWorker$2.handle(DefaultUnreliableWorker.java:109) at com.atlassian.applinks.oauth.auth.OAuthApplinksResponseHandler$1.handle(OAuthApplinksResponseHandler.java:122) at com.atlassian.applinks.oauth.auth.OAuthApplinksResponseHandler.handle(OAuthApplinksResponseHandler.java:78) at com.atlassian.plugins.rest.module.jersey.JerseyRequest$2.handle(JerseyRequest.java:134) at com.atlassian.sal.core.net.HttpClientRequest.executeAndReturn(HttpClientRequest.java:102) at com.atlassian.plugins.rest.module.jersey.JerseyRequest.executeAndReturn(JerseyRequest.java:131) at com.atlassian.applinks.core.auth.ApplicationLinkRequestAdaptor.execute(ApplicationLinkRequestAdaptor.java:58) at com.atlassian.applinks.oauth.auth.ThreeLeggedOAuthRequest.execute(ThreeLeggedOAuthRequest.java:52) at com.atlassian.mywork.client.reliability.DefaultUnreliableWorker.send(DefaultUnreliableWorker.java:109) at com.atlassian.mywork.client.reliability.DefaultUnreliableWorker.access$200(DefaultUnreliableWorker.java:27) at com.atlassian.mywork.client.reliability.DefaultUnreliableWorker$1$1.run(DefaultUnreliableWorker.java:72) ... 4 more Exception in thread "com.atlassian.mywork.client.reliability.DefaultUnreliableWorker:thread-427" java.lang.RuntimeException: com.atlassian.sal.api.net.ResponseException: 500 - at com.atlassian.mywork.client.reliability.DefaultUnreliableWorker$1$1.run(DefaultUnreliableWorker.java:81)