Need help for the correct multline pattern

Elastic Stack Beats
1

Hi
I have to write multiline pattern in the filebeat.yml for the below logs for a tomcat server
Please suggest what would be the correct pattern

2018-02-24 09:11:25,757 localhost-startStop-2 INFO [c.a.jira.startup.DefaultJiraLauncher] Stopping launchers
2018-02-24 09:11:25,761 localhost-startStop-2 ERROR [o.a.c.c.C.[Catalina].[localhost].[/]] Exception sending context destroyed event to listener instance of class com.atlassian.jira.startup.LauncherContextListener
java.lang.NullPointerException
at com.atlassian.jira.startup.ClusteringLauncher.stop(ClusteringLauncher.java:31)
at com.atlassian.jira.startup.DefaultJiraLauncher.stop(DefaultJiraLauncher.java:166)
at com.atlassian.jira.startup.LauncherContextListener.contextDestroyed(LauncherContextListener.java:127)
at org.apache.catalina.core.StandardContext.listenerStop(StandardContext.java:4751)
at org.apache.catalina.core.StandardContext.stopInternal(StandardContext.java:5352)
... 3 filtered
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
24-Feb-2018 09:11:25.804 INFO [main] org.apache.coyote.AbstractProtocol.stop Stopping ProtocolHandler ["http-nio-8080"]
24-Feb-2018 09:11:25.805 INFO [main] org.apache.coyote.AbstractProtocol.destroy Destroying ProtocolHandler ["http-nio-8080"]
24-Feb-2018 10:31:31.600 WARNING [main] org.apache.tomcat.util.digester.SetPropertiesRule.begin [SetPropertiesRule]{Server/Service/Engine/Valve} Setting property 'resolveHosts' to 'false' did not find a matching property.

Regards
Vipra Bhatia

2

Please format your logs using </>, so a correct pattern can be worked out.

With this unformatted log I assume it's possible to match for timestamps. But without the formatted logs I am not sure it works, so please test it.

multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after

You can find more examples here: https://www.elastic.co/guide/en/beats/filebeat/6.2/_examples_of_multiline_configuration.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.