Multiline pattern with grok filter


(Keshav Agarwal) #1

I am trying to use grok filter for getting multiline patterns in logstash. I've tried using the GRREDYDATA but it doesn't seem to work. Any other method I can opt for doing the multiline pattern match?


(Naveenz) #2

Would suggest you to test your grok pattern here - http://grokconstructor.appspot.com/

An example pattern like the one below worked fine for me:

%{TIMESTAMP_ISO8601:logtime}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{NOTSPACE:threadname}%{SPACE}%{NOTSPACE:useremail}%{SPACE}(%{JAVAFILE:filename}:%{NUMBER:linenumber})%{SPACE}-%{SPACE}%{GREEDYDATA:logmessage}

Log message: 2015-06-14 00:15:07,763 ERROR [Timer-6] <> (xxxStatusUpdater.java:641) - xxxStatusUpdater.updatexxxStatuses: Generic Exception Getting Status From xxx! Year out of range.; nested exception is java.sql.BatchUpdateException: Year out of range.
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:83)
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:80)
at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:80)


(system) #3