# Parsing logs with stack trace

**URL:** <https://discuss.elastic.co/t/parsing-logs-with-stack-trace/156514>\
**Category:** Logstash\
**Created:** [November 13, 2018, 4:39pm UTC](https://discuss.elastic.co/t/parsing-logs-with-stack-trace/156514 "2018-11-13T16:39:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vvn84](https://avatars.discourse-cdn.com/v4/letter/v/7cd45c/32.png) [@vvn84](https://discuss.elastic.co/u/vvn84)\
**Post date:** [November 13, 2018, 4:39pm UTC](https://discuss.elastic.co/t/parsing-logs-with-stack-trace/156514/1 "2018-11-13T16:39:00Z")

</div>

Hi,

I have a situation where I am parsing logs that usually are in a structured format and am able to parse it and index them. But when there is an error, there is stacktrace which spans multiple lines and hence the grok pattern fails. An example is as follows:

Grok Pattern:  
match =\> [  
"message" , "\<%{NUMBER:syslog\_pri}\>%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program} %{TIMESTAMP\_ISO8601:timestamp} [%{DATA:loglevel}] %{DATA:class} [%{DATA:operation}] (user=%{DATA:userid}) (?m)%{GREEDYDATA:stacktrace}"

Log message example:  
2018-11-12 12:15:11,893 [INFO] Dummy Message: [Type] (user=abc, key=xyz) **SKIP**

So the above message gets parsed without any issues. But the following it doesnt parse the whole stacktrace:

##################################################################  
2018-11-12 12:15:13,688 [ERROR] Dummy Message [Error] (user=abc) Unhandled exception encountered...  
Bla bla bla  
bla Bla bLna  
bla bla bla  
#################################################################

Any way to include all the stacktrace?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2018, 4:39pm UTC](https://discuss.elastic.co/t/parsing-logs-with-stack-trace/156514/2 "2018-12-11T16:39:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.