# Parsing python traceback in multiline mode

**URL:** <https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 9, 2016, 7:08am UTC](https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291 "2016-06-09T07:08:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SergeyParamoshkin](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@SergeyParamoshkin](https://discuss.elastic.co/u/SergeyParamoshkin)\
**Post date:** [June 9, 2016, 7:08am UTC](https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291/1 "2016-06-09T07:08:44Z")

</div>

Hi, maybe someone had a problem parsing the logs, where there is a python stacktrace.  
What should be the regex pattern

filebeat configuration:

```auto
 multiline:
        pattern: ^\[
        negate: false
        match: after

```

os configuration:

```auto
Red Hat Enterprise Linux Server release 6.7 (Santiago)

```

logs sample

```auto
ERROR 2016-06-08 15:24:15,132 HostInfo.py:229 - Checking java processes failed
Traceback (most recent call last):
  File "/usr/lib/python2.6/site-packages/ambari_agent/HostInfo.py", line 212, in javaProcs
    cmd = open(os.path.join('/proc', pid, 'cmdline'), 'rb').read()

```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 9, 2016, 10:55am UTC](https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291/2 "2016-06-09T10:55:54Z")

</div>

Did you have a look here? [https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html#multiline](https://www.elastic.co/guide/en/beats/filebeat/1.2/configuration-filebeat-options.html#multiline) In case you have ERROR on each new multiline, you could go for checking for ERROR.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [June 9, 2016, 2:06pm UTC](https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291/3 "2016-06-09T14:06:13Z")

</div>

home come you opted for `^\[` as your regex pattern? If log levels are known you can try:

`pattern: 'ERROR|INFO|DEBUG|WARN'` with `negate:true` and so on. Alternatively (if it's just stack traces) try  
`pattern: '^Traceback|^[[:space:]]+'` with `negate: false`.

Here is some test script (click run button): [https://play.golang.org/p/S6cvSTu-on](https://play.golang.org/p/S6cvSTu-on)

Don't use single events when testing multiline (or reporting issues). Adding additional potential logs can change the required pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2016, 7:09am UTC](https://discuss.elastic.co/t/parsing-python-traceback-in-multiline-mode/52291/4 "2016-06-30T07:09:09Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.