Hi
below given is one of the logs:
6220 04:22:28 ERROR Error in RedirectProcessor
Exception: System.Threading.ThreadAbortException
Message: Thread was being aborted.
Source: YY.yyy.yyyyyy
at YY.yyyyy.Yyyyyy.zzz.RedirectProcessor.RouteRequest(xyz, HttpRequestArgs args)
at YY.yyyyy.Yyyyyy.zzz.RedirectProcessor.Process(HttpRequestArgs args)
my filter is:
filter {
grok {
match => { "message" => "%{NUMBER:Pid:int} %{TIME:time} %{WORD:Level} %{GREEDYDATA:msg}"}
}
mutate {
remove_field => [ "message"]
}
}
now in my GREEDYDATA: msg part, i'm getting the following data
Error in RedirectProcessor
Exception: System.Threading.ThreadAbortException
Message: Thread was being aborted.
Source: YY.yyy.yyyyyy
at YY.yyyyy.Yyyyyy.zzz.RedirectProcessor.RouteRequest(yyy, HttpRequestArgs args)
at YY.yyyyy.Yyyyyy.zzz.RedirectProcessor.Process(HttpRequestArgs args)
Is there any way that i can get the first 4 lines as separate fields. ie.,
Error_details : Error in RedirectProcessor
Exception : System.Threading.ThreadAbortException
Message: Thread was being aborted.
Source : YY.yyy.yyyyyy
and the last 2 lines as another field.
Someone please help me with this. I'm trying to solve this for long.
thanks
ANnu