Negative look behind not working

Elastic Stack Logstash
1

I am trying to match a line in the logfile which does not start with "Caused by" but the negative lookbehind I am using is not working, even though it works in the grok debugger and also in rubular (http://rubular.com/r/N3AzySNHiS) but does not work in logstash

grok {
        patterns_dir => ["./patterns"]
        match => ["message", "%{GREEDYDATA}\n%{JAVA_EXCEPTION_SHORT:exception}"]
}

Regex
^(?!Caused by: ).*?Exception

Message

> 2016-11-15 05:19:28,801 ERROR [App-Initialisation-Thread] appengine.java:520 Failed to initialize external authenticator myapp Support Access || appuser@vm23-13:/mnt/data/install/assembly app-1.4.12@cad85b224cce11eb5defa126030f21fa867b0dad
> java.lang.IllegalArgumentException: Could not check if provided root is a directory
> 	at com.myapp.jsp.KewServeInitContextListener$1.run(QServerInitContextListener.java:104)
> 	at java.lang.Thread.run(Thread.java:745)
> Caused by: java.nio.file.NoSuchFileException: fh-ldap-config/
> 	at com.upplication.s3fs.util.S3Utils.getS3ObjectSummary(S3Utils.java:55)
> 	at com.upplication.s3fs.util.S3Utils.getS3FileAttributes(S3Utils.java:64)

Logstash Result
"exception" => "Caused by: java.nio.file.NoSuchFileException"

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.