Multiple matches in grok won't work

Hi,
my logs :

[9/16/18 19:00:22:154 CEST] 00001609 SystemOut     O 2018-09-16 19:00:22,154 ERROR [ContentQueueWorker_ADR_Worker background task processing6064] - Failed to delete Centera clip id 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD (Centera error code: -10005)
com.filepool.fplibrary.FPLibraryException: com.emc.vipr.cashead.api.InternalObjectException: Unable to set object metadata for: 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD
	at com.emc.vipr.cashead.impl.vipr.ExceptionTranslator.translateError(ExceptionTranslator.java:40)
	at com.emc.vipr.cashead.impl.vipr.BlobClientObjectDatastore.setObjectMetadata(BlobClientObjectDatastore.java:321)
	at com.emc.vipr.cashead.storageserver.access.transaction.delete.UpdateMetadata.performAction(UpdateMetadata.java:32)
[9/16/18 19:00:22:154 CEST] 00001609 SystemOut     O 1032332946 [ContentQueueWorker_ADR_Worker background task processing6064] ERROR filenet_error.fixed_content_provider.com.filenet.engine.content.fcprovider.centera.CenteraAdaptor  - Failed to delete Centera clip id 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD (Centera error code: -10005)
com.filepool.fplibrary.FPLibraryException: com.emc.vipr.cashead.api.InternalObjectException: Unable to set object metadata for: 840VGECLTS8FAe7GT8CKT6LF91AG41CHNC9VU204BR9L02LJTO2BD
	at com.emc.vipr.cashead.impl.vipr.ExceptionTranslator.translateError(ExceptionTranslator.java:40)
	at com.emc.vipr.cashead.impl.vipr.BlobClientObjectDatastore.setObjectMetadata(BlobClientObjectDatastore.java:321)
[9/17/18 12:30:11:507 CEST] 000016f7 SystemOut     O 2018-09-17 12:30:11,507  WARN [CSEIndexProcessor$BatchExecutor_null_Worker background task processing7140] - No text was produced from the extraction process for /opt/filenet/collections_temp/sl008848/cpe1member01/OS{B0E9EAD3-6229-407F-AD9E-443B23620D16}/FN17/FN10/FN22/FN{4011E765-0000-CF12-AFA2-A450427591D0}{514DD4A4-6D3B-48B2-B400-CB2ECE734A75}-0.pdf object:{4011E765-0000-CF12-AFA2-A450427591D0} class:InvoicePaymentOrderBookingVoucher Reason: NO_TEXT_EXTRACTED
[7/30/18 4:25:27:036 CEST] 0000011e SetDateProper I de.abs.ecm.filenet.eventactions.SetDatePropertyOnVersionPromotion onPromoteVersionEvent Property SentOn an Dokument ID={20DCE864-0000-CB14-A6A5-2AC66640F647} auf den Wert 2018-07-30 04:25:26.933 gesetzt.
[7/30/18 9:32:54:708 CEST] 0000006f InheritDossie E de.abs.ecm.filenet.eventactions.InheritDossierPropertiesOnFiledIn inheritDossierProperties Bei der Ausführung einer EventAction ist ein Fehler aufgetreten: Das Dokument ID={806BC764-0200-C1AB-ACED-49213624A58B} liegt in mehr als einem Ordner vor, Zuweisung der Sicherheitseinstellungen nicht möglich
    java.lang.Runtime.
	at com.emc.vipr.cashead.impl.vipr.ExceptionTranslator.translateError(ExceptionTranslator.java:40)
	at com.emc.vipr.cashead.impl.vipr.BlobClientObjectDatastore.setObjectMetadata(BlobClientObjectDatastore.java:321)
[9/17/18 15:01:43:995 CEST] 0000176f InheritDossie I de.abs.ecm.filenet.eventactions.InheritDossierPropertyValues setProperty Property konnte nicht gesetzt werden, da nicht gefunden: AnualTurnOver

my logstash configuration:

input { beats {port => 5044 } }

filter {


# CPE JVM log pattern
 if [fields][log_type] == "SystemOut-CPE-JVM" {
 grok {
 break_on_match => false
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} [ ]* %{WORD:sev} %{NOTSPACE} \[%{DATA}\] %{LOGLEVEL:log-level} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} [ ]* %{WORD:sev} %{TIMESTAMP_ISO8601} %{LOGLEVEL:log-level} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} [ ]* %{WORD:sev} %{TIMESTAMP_ISO8601} [ ]* %{LOGLEVEL:log-level} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} [ ]* %{DATA:sev} %{NOTSPACE} %{GREEDYDATA:msg}" }
 match => { "message" => "%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:log-source} %{WORD:sev} %{NOTSPACE:package} %{WORD:methode} %{GREEDYDATA:msg}" }
  }
  mutate { replace => [ "type", "SystemOut-CPE-JVM_log" ] }
}

}
output {

stdout { codec => rubydebug }

  elasticsearch {
        hosts => ["localhost:9200"]
        index => "test_1"
}
}

the main problem is i'm not able to parse all above logs together, but it work fine when i parse the log-entries separately.
I set up the break_on_match to false but still not working for all matches together.

any idea why it's not working, thanks in advance

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.