Negative look behind not working

(Arthur Francis) #1

I am trying to match a line in the logfile which does not start with "Caused by" but the negative lookbehind I am using is not working, even though it works in the grok debugger and also in rubular ( but does not work in logstash

grok {
        patterns_dir => ["./patterns"]
        match => ["message", "%{GREEDYDATA}\n%{JAVA_EXCEPTION_SHORT:exception}"]

^(?!Caused by: ).*?Exception


> 2016-11-15 05:19:28,801 ERROR [App-Initialisation-Thread] Failed to initialize external authenticator myapp Support Access || appuser@vm23-13:/mnt/data/install/assembly app-1.4.12@cad85b224cce11eb5defa126030f21fa867b0dad
> java.lang.IllegalArgumentException: Could not check if provided root is a directory
> 	at com.myapp.jsp.KewServeInitContextListener$
> 	at
> Caused by: java.nio.file.NoSuchFileException: fh-ldap-config/
> 	at com.upplication.s3fs.util.S3Utils.getS3ObjectSummary(
> 	at com.upplication.s3fs.util.S3Utils.getS3FileAttributes(

Logstash Result
"exception" => "Caused by: java.nio.file.NoSuchFileException"

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.