Need help for the correct multline pattern

I have to write multiline pattern in the filebeat.yml for the below logs for a tomcat server
Please suggest what would be the correct pattern

2018-02-24 09:11:25,757 localhost-startStop-2 INFO [c.a.jira.startup.DefaultJiraLauncher] Stopping launchers
2018-02-24 09:11:25,761 localhost-startStop-2 ERROR [o.a.c.c.C.[Catalina].[localhost].[/]] Exception sending context destroyed event to listener instance of class com.atlassian.jira.startup.LauncherContextListener
at com.atlassian.jira.startup.ClusteringLauncher.stop(
at com.atlassian.jira.startup.DefaultJiraLauncher.stop(
at com.atlassian.jira.startup.LauncherContextListener.contextDestroyed(
at org.apache.catalina.core.StandardContext.listenerStop(
at org.apache.catalina.core.StandardContext.stopInternal(
... 3 filtered
at java.util.concurrent.ThreadPoolExecutor.runWorker(
at java.util.concurrent.ThreadPoolExecutor$
24-Feb-2018 09:11:25.804 INFO [main] org.apache.coyote.AbstractProtocol.stop Stopping ProtocolHandler ["http-nio-8080"]
24-Feb-2018 09:11:25.805 INFO [main] org.apache.coyote.AbstractProtocol.destroy Destroying ProtocolHandler ["http-nio-8080"]
24-Feb-2018 10:31:31.600 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Valve} Setting property 'resolveHosts' to 'false' did not find a matching property.

Vipra Bhatia

Please format your logs using </>, so a correct pattern can be worked out.

With this unformatted log I assume it's possible to match for timestamps. But without the formatted logs I am not sure it works, so please test it.

multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

You can find more examples here:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.