# Multiline pattern for system logs **URL:** \ **Category:** Logstash\ **Created:** [January 22, 2018, 11:24am UTC](https://discuss.elastic.co/t/multiline-pattern-for-system-logs/116473 "2018-01-22T11:24:14Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![aditi.puri](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@aditi.puri](https://discuss.elastic.co/u/aditi.puri)\ **Post date:** [January 22, 2018, 11:24am UTC](https://discuss.elastic.co/t/multiline-pattern-for-system-logs/116473/1 "2018-01-22T11:24:14Z")
i am trying to capture the full error description in my system log file.using the below pattern "^\<\>%{SPACE}[%{MONTH} %{MONTHDAY}%{TIME}]". But i am not bale to capture the error description. Please help in getting me the correct pattern, My Log file looks like below: \<\> [Jan 17 16:51:04] [[ACTIVE] ExecuteThread: '67' for queue: 'weblogic.kernel.Default (self-tuning)'] [RPL] \ encountered an exception from which recovery-by-retry is NOT possible. This flow will NOT be retried. Last retry count = \<0 out of 0\> \<\> [Jan 17 17:34:20] [Thread-74] [RPL] socket error:Connection reset \<\> [Jan 17 17:34:20] [Thread-74] [RPL] Error occured so DiameterConnectionHandler is expiring the connection Connection Host: 10.75.30.6 Port: 20901 Socket Request Obj ID: amdocs.rpm.services.PPSRequest@1ca63f3b Socket hashcode: 1936542461 Connection Obj ID: 819329938 Status: [rpmsts=O] Site Name: DEFAULT ThrottlingTime: 0 OverloadedFRsRetryCount: -1 setSocketCreationFailed = TRUE \<\> [Jan 17 17:34:20] [Thread-74] [RPL] socket error:Connection reset \<\> [Jan 17 17:34:20] [Thread-74] [RPL] Error occured so DiameterConnectionHandler is expiring the connection Connection Host: 10.75.30.6 Port: 20631 Socket Request Obj ID: amdocs.rpm.services.PPSRequest@12c862d0 Socket hashcode: 1798098567 Connection Obj ID: 1456345569 Status: [rpmsts=O] Site Name: DEFAULT ThrottlingTime: 0 OverloadedFRsRetryCount: -1 setSocketCreationFailed = TRUE \<\> [Jan 17 17:34:23] [Thread-73] [RPL] Ignoring the IOException inside BadQueueRecovery connection : Connection Host: 10.75.30.6 Port: 20901 Socket Request Obj ID: amdocs.rpm.services.PPSRequest@1ca63f3b Socket hashcode: 1936542461 Connection Obj ID: 819329938 Status: [rpmsts=O] Site Name: DEFAULT ThrottlingTime: 0 OverloadedFRsRetryCount: -1 Error-message Connection refused \<\> [Jan 17 17:34:23] [Thread-73] [RPL] Ignoring the IOException inside BadQueueRecovery connection : Connection Host: 10.75.30.6 Port: 20631 Socket Request Obj ID: amdocs.rpm.services.PPSRequest@12c862d0 Socket hashcode: 1798098567 Connection Obj ID: 1456345569 Status: [rpmsts=O] Site Name: DEFAULT ThrottlingTime: 0 OverloadedFRsRetryCount: -1 Error-message Connection refused \<\> [Jan 17 17:34:28] [Thread-73] [RPL] Ignoring the IOException inside BadQueueRecovery connection : Connection Host: 10.75.30.6 Port: 20901 Socket Request Obj ID: amdocs.rpm.services.PPSRequest@1ca63f3b Socket hashcode: 1936542461 Connection Obj ID: 819329938 Status: [rpmsts=O] Site Name: DEFAULT ThrottlingTime: 0 OverloadedFRsRetryCount: -1 Error-message Connection refused \<\> [Jan 17 17:34:28] [Thread-73] [RPL] Ignoring the IOException inside BadQueueRecovery connection : Connection Host: 10.75.30.6 Port: 20631 Socket Request Obj ID: amdocs.rpm.services.PPSRequest@12c862d0 Socket hashcode: 1798098567 Connection Obj ID: 1456345569 Status: [rpmsts=O] Site Name: DEFAULT ThrottlingTime: 0 OverloadedFRsRetryCount: -1 Error-message Connection refused \<\> [Jan 17 19:37:43] [[ACTIVE] ExecuteThread: '53' for queue: 'weblogic.kernel.Default (self-tuning)'] [RPL] [ABPBatchUser] amdocs.rpm.utils.exceptions.RPMResourceException: (RPL1-000115) The activity failed in Amdocs Balance Manager with the \<10, API RECEIVE RESPONSE :Read timed out\> error code. at amdocs.rpm.utils.balance.TCPBalanceManagerServer.connErrorHandle(TCPBalanceManagerServer.java:312) at amdocs.rpm.utils.balance.TCPBalanceManagerServer.invokeOlcActivity(TCPBalanceManagerServer.java:292) at amdocs.rpm.utils.balance.RPLOlcImpl.invokeMessage(RPLOlcImpl.java:126) at amdocs.rpm.flowcontrol.RPL9AddOfferFC.l9AddOffer(RPL9AddOfferFC.java:114) at amdocs.rpm.local.implementation.RPL9AddOfferProxy.l9AddOffer(RPL9AddOfferProxy.java:291) at amdocs.rpm.sessions.implementation.RPL1RechargeServicesBean.l9AddOffer(RPL1RechargeServicesBean.java:4784) at amdocs.rpm.sessions.implementation.RPL1RechargeServicesBean\_uqrjz6\_EOImpl.\_\_WL\_invoke(Unknown Source) at weblogic.ejb.container.internal.SessionRemoteMethodInvoker.invokeInternal(SessionRemoteMethodInvoker.java:54) at weblogic.ejb.container.internal.SessionRemoteMethodInvoker.invoke(SessionRemoteMethodInvoker.java:21) at amdocs.rpm.sessions.implementation.RPL1RechargeServicesBean\_uqrjz6\_EOImpl.l9AddOffer(Unknown Source) at amdocs.rpm.sessions.implementation.RPL1RechargeServicesBean\_uqrjz6\_EOImpl\_WLSkel.invoke(Unknown Source) at weblogic.rmi.internal.ServerRequest.sendReceive(ServerRequest.java:252) at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:553) at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:313) at amdocs.rpm.sessions.implementation.RPL1RechargeServicesBean\_uqrjz6\_EOImpl\_12212\_WLStub.l9AddOffer(Unknown Source) at amdocs.csm3g.flowcontrol.CM9SubscriberServicesAddOfferFC.rplAddOffer(CM9SubscriberServicesAddOfferFC.java:1100) at amdocs.csm3g.flowcontrol.CM9SubscriberServicesAddOfferFC.l9AddOffer(CM9SubscriberServicesAddOfferFC.java:605) at amdocs.csm3g.local.implementation.CM9SubscriberServicesAddOfferProxy.l9AddOffer(CM9SubscriberServicesAddOfferProxy.java:519) at amdocs.csm3g.sessions.implementation.SubscriberServicesBean.l9AddOffer(SubscriberServicesBean.java:18499) at amdocs.csm3g.sessions.implementation.SubscriberServicesBean\_gl6i2n\_EOImpl.\_\_WL\_invoke(Unknown Source) at weblogic.ejb.container.internal.SessionRemoteMethodInvoker.invokeInternal(SessionRemoteMethodInvoker.java:54) at weblogic.ejb.container.internal.SessionRemoteMethodInvoker.invoke(SessionRemoteMethodInvoker.java:21) at amdocs.csm3g.sessions.implementation.SubscriberServicesBean\_gl6i2n\_EOImpl.l9AddOffer(Unknown Source) at amdocs.csm3g.sessions.implementation.SubscriberServicesBean\_gl6i2n\_EOImpl\_WLSkel.invoke(Unknown Source) at weblogic.rmi.internal.BasicServerRef.invoke(BasicServerRef.java:645) at weblogic.rmi.cluster.ClusterableServerRef.invoke(ClusterableServerRef.java:246) at weblogic.rmi.internal.BasicServerRef$2.run(BasicServerRef.java:534) at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:368) at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:163) at weblogic.rmi.internal.BasicServerRef.handleRequest(BasicServerRef.java:531) at weblogic.rmi.internal.wls.WLSExecuteRequest.run(WLSExecuteRequest.java:138) at ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [January 24, 2018, 11:09am UTC](https://discuss.elastic.co/t/multiline-pattern-for-system-logs/116473/2 "2018-01-24T11:09:58Z")
Hi, could you format (markdown) your patterns and logs for ease of readability, please. Can you share a full line of the system log you want to parse and share the full logstasah input, filter, output. ---
**Author:** ![aditi.puri](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@aditi.puri](https://discuss.elastic.co/u/aditi.puri)\ **Post date:** [January 24, 2018, 2:44pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-system-logs/116473/3 "2018-01-24T14:44:38Z")
Please refer to discussion going on- > [@Miltiline filter pattern](https://discuss.elastic.co/t/miltiline-filter-pattern/116089): > > Hi, can you please help me with multiline filters, below is the exception that i need to capture \<\> [Jan 17 17:04:24] [[ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'] [CM] [ABPBatchUser] ======Error Stack Trace : ========= amdocs.csm3g.exceptions.CMException: (CM1-001013) The node info or the related details are not availabile for the subscriber. at amdocs.csm3g.datacontrol.entities.Unit.validateActivityAllowedOnUnit(Unit.java:1474) at amdocs.csm3g.flowcontr… and > ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2018, 2:45pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-system-logs/116473/4 "2018-02-21T14:45:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.