# Need help for multiline hyperic tomcat wrapper logs with datestamp on each line of the exception

**URL:** <https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096>\
**Category:** Logstash\
**Created:** [November 19, 2015, 11:18pm UTC](https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096 "2015-11-19T23:18:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![richinkansal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richinkansal/32/6033_2.png) [@richinkansal](https://discuss.elastic.co/u/richinkansal)\
**Post date:** [November 19, 2015, 11:18pm UTC](https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096/1 "2015-11-19T23:18:52Z")

</div>

# Request:

Need help for multiline hyperic tomcat wrapper logs with datestamp on each line of the exception.  
We have developed below mentioned grok filters for the single line wrapper logs but unable to convert that into multiline as every line has timestamp at the starting of each log line unlike regular tomcat logs. Any help is highly appreciated.

# Grok Filters Developed so far for single line:

JVMNAME %{WORD:jvm} %{INT:number}

WRAPPER\_DATESTAMP 20%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND})

GREEDYDATA .\*

# WRAPPERLOG %{LOGLEVEL:level} +| +%{JVMNAME:jvmname} +| +%{WRAPPER\_DATESTAMP:timestamp} +| +%{GREEDYDATA:logmessage

# Multiline Wrapper Log Message Format:

INFO | jvm 1 | 2015/09/23 08:07:20 | ActionConfig[cancellable=false,path=/sessionAuditTrail,validate=false,input=/sessionAuditTrail.do,name=sessionAuditTrailForm,scope=request,type=com.example.test.actions.ExampleDelegationtestAction  
INFO | jvm 1 | 2015/09/23 08:09:44 | ActionConfig[cancellable=false,path=/FleetAvailability,validate=true,scope=session,type=com.example.test.actions.ExampleDelegationtestAction  
INFO | jvm 1 | 2015/09/23 08:09:44 | - This action exception intercepted by Spring ExceptionInterceptor  
INFO | jvm 1 | 2015/09/23 08:09:44 | java.lang.NumberFormatException: null  
INFO | jvm 1 | 2015/09/23 08:09:44 | at java.lang.Long.parseLong(Long.java:375)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at java.lang.Long.valueOf(Long.java:525)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at com.example.test.actions.FleetAvailabilityAction.execute(FleetAvailabilityAction.java:147)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at sun.reflect.GeneratedMethodAccessor921.invoke(Unknown Source)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at java.lang.reflect.Method.invoke(Method.java:597)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.framework.adapter.MethodBeforeAdviceInterceptor.invoke(MethodBeforeAdviceInterceptor.java:51)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.framework.adapter.ThrowsAdviceInterceptor.invoke(ThrowsAdviceInterceptor.java:124)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at $Proxy164.execute(Unknown Source)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at sun.reflect.GeneratedMethodAccessor921.invoke(Unknown Source)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at java.lang.reflect.Method.invoke(Method.java:597)  
INFO | jvm 1 | 2015/09/23 08:09:44 | at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 20, 2015, 3:43am UTC](https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096/2 "2015-11-20T03:43:54Z")

</div>

You may want to look at the [aggregate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html), you can probably just agg on the timestamp and join things.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 20, 2015, 6:42am UTC](https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096/3 "2015-11-20T06:42:13Z")

</div>

If all lines begin in the same way, how can you tell if a line is a continuation of the previous?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096/4 "2017-07-06T05:22:02Z")

</div>