Hi, I have JSON log that is created by Log4j2 and was read by LogStash. But sometimes, when log object has long inner trace, it is divided and appears as separated logs on my kibana.
Here is my config:
input {
file {
codec => multiline
{
pattern => '^\{'
negate => true
what => previous
max_lines => 10000
}
path => "C:/logs/webapp-errors.log"
add_field => ["app", "hhh"]
start_position => "beginning"
sincedb_path => "D:/Development/logstash-2.2.0/logstash-2.2.0/dbfile/null"
}
}
filter
{
json { source => message }
}
output {
elasticsearch {
hosts => ["localhost:9200"]
codec => "json"
}
stdout { codec => rubydebug }
}And my log looks like:
{
"timeMillis" : 1457019625620,
"thread" : "http-nio-8080-exec-20",
"level" : "WARN",
"loggerName" : "org.springframework.beans.factory.config.PropertyPlaceholderConfigurer",
"message" : "Could not load properties from URL [file:C:/Users/bilguuna/conf/hsprograms.properties]: C:\\Users\\bilguuna\\conf\\hsprograms.properties (The system can't find the file specified)",
"endOfBatch" : false,
"loggerFqcn" : "org.apache.commons.logging.impl.SLF4JLocationAwareLog"
}
{
"timeMillis" : 1457019625720,
"thread" : "http-nio-8080-exec-20",
"level" : "WARN",
"loggerName" : "org.springframework.web.context.support.XmlWebApplicationContext",
"message" : "Exception encountered during context initialization - cancelling refresh attempt",
"thrown" : {
"commonElementCount" : 0,
"localizedMessage" : "Invalid bean definition with name 'wicketApplication' defined in class path resource [hsprograms-core-context.xml]: Could not resolve placeholder 'melissa.customer.id' in string value \"${melissa.customer.id}\"; nested exception is java.lang.IllegalArgumentException: Could not resolve placeholder 'melissa.customer.id' in string value \"${melissa.customer.id}\"",
"message" : "Invalid bean definition with name 'wicketApplication' defined in class path resource [hsprograms-core-context.xml]: Could not resolve placeholder 'melissa.customer.id' in string value \"${melissa.customer.id}\"; nested exception is java.lang.IllegalArgumentException: Could not resolve placeholder 'melissa.customer.id' in string value \"${melissa.customer.id}\"",
"name" : "org.springframework.beans.factory.BeanDefinitionStoreException",
"cause" : {
"commonElementCount" : 60,
"localizedMessage" : "Could not resolve placeholder 'melissa.customer.id' in string value \"${melissa.customer.id}\"",
"message" : "Could not resolve placeholder 'melissa.customer.id' in string value \"${melissa.customer.id}\"",
"name" : "java.lang.IllegalArgumentException",
"extendedStackTrace" : [ {
"class" : "org.springframework.util.PropertyPlaceholderHelper",
"method" : "parseStringValue",
"file" : "PropertyPlaceholderHelper.java",
"line" : 174,
"exact" : false,
"location" : "spring-core-4.2.2.RELEASE.jar",
"version" : "4.2.2.RELEASE"
}, {
"class" : "org.springframework.util.PropertyPlaceholderHelper",
"method" : "replacePlaceholders",
"file" : "PropertyPlaceholderHelper.java",
"line" : 126,
"exact" : false,
"location" : "spring-core-4.2.2.RELEASE.jar",
"version" : "4.2.2.RELEASE"
} ]
},
"extendedStackTrace" : [ {
"class" : "org.springframework.beans.factory.config.PlaceholderConfigurerSupport",
"method" : "doProcessProperties",
"file" : "PlaceholderConfigurerSupport.java",
"line" : 211,
"exact" : false,
"location" : "spring-beans-4.2.2.RELEASE.jar",
"version" : "4.2.2.RELEASE"
}, {
"class" : "org.springframework.beans.factory.config.PropertyPlaceholderConfigurer",
"method" : "processProperties",
"file" : "PropertyPlaceholderConfigurer.java",
"line" : 222,
"exact" : false,
"location" : "spring-beans-4.2.2.RELEASE.jar",
"version" : "4.2.2.RELEASE"
}]
},
"endOfBatch" : false,
"loggerFqcn" : "org.apache.commons.logging.impl.SLF4JLocationAwareLog"
}
and kibana looks like:
Divided objects are appeared as separated ones in above image. PS: All objects in the log has to have level (error or warn),
Is that because of nested objects in json? Thank you