Parsing of logs with multiline filter

Elastic Stack Logstash
1

i am java stack trace need to parse i am not getting the pattern to do the same i had tried different patterns for the same
Current Date : Tue Sep 06 05:56:51 EDT 2016 | Current user : admin
Exception during logging :
java.lang.NullPointerException
at com.usb2c.core.interceptors.Usb2cProductValidateInterceptor.onValidate(Usb2cProductValidateInterceptor.java:53)
at de.hybris.platform.servicelayer.internal.model.impl.wrapper.ModelWrapper.invokeValidateInterceptors(ModelWrapper.java:272)
at de.hybris.platform.servicelayer.internal.model.impl.wrapper.ModelWrapper.validate(ModelWrapper.java:216)
at de.hybris.platform.servicelayer.internal.model.extractor.impl.DefaultModelExtractor.process(DefaultModelExtractor.java:60)
at de.hybris.platform.servicelayer.internal.model.impl.DefaultModelService.performPersistenceOperations(DefaultModelService.java:625)
at de.hybris.platform.servicelayer.internal.model.impl.DefaultModelService.saveAllInternal(DefaultModelService.java:620)
at de.hybris.platform.servicelayer.internal.model.impl.DefaultModelService.saveAll(DefaultModelService.java:600)
at de.hybris.platform.servicelayer.internal.model.impl.DefaultModelService.save(DefaultModelService.java:548)
at de.hybris.platform.servicelayer.impex.impl.SLImpexImportCUDHandler.doCreate(SLImpexImportCUDHandler.java:111)
at de.hybris.platform.impex.jalo.imp.DefaultImpExImportCUDHandler.create(DefaultImpExImportCUDHandler.java:221)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor.processItemCreation(DefaultImportProcessor.java:746)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor.processInsertLine(DefaultImportProcessor.java:514)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor.processInsertUpdateLineInternal(DefaultImportProcessor.java:446)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor.access$0(DefaultImportProcessor.java:439)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor$3.execute(DefaultImportProcessor.java:428)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor$3.execute(DefaultImportProcessor.java:1)
at de.hybris.platform.tx.Transaction.execute(Transaction.java:1195)
at de.hybris.platform.tx.Transaction.execute(Transaction.java:1160)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor.processInsertUpdateLine(DefaultImportProcessor.java:423)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor.processItemData_Impl(DefaultImportProcessor.java:250)
at de.hybris.platform.impex.jalo.imp.DefaultImportProcessor.processItemData(DefaultImportProcessor.java:149)
at de.hybris.platform.impex.jalo.imp.MultiThreadedImportProcessor.processItemData(MultiThreadedImportProcessor.java:102)
at de.hybris.platform.impex.jalo.imp.MultiThreadedImpExImportReader.processValueLineFromWorker(MultiThreadedImpExImportReader.java:534)
at de.hybris.platform.impex.jalo.imp.ImpExWorker.perform(ImpExWorker.java:154)
at de.hybris.platform.impex.jalo.imp.ImpExWorker.run(ImpExWorker.java:87)
at de.hybris.platform.util.threadpool.PoolableThread.run(PoolableThread.java:198)

Please help me in order to get the pattern for the above log

2

You should be able to use a pattern such as the one below (common for java stack traces) with the codec parameter in your file input:

file {
   path => "/your/file/path"
   codec => multiline {
      pattern => "^\s"
      what => "previous"
   }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.