# Parsing Websphere SysErr log file using logstash
**URL:** https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677
**Category:** Logstash
**Created:** [January 7, 2016, 11:36pm UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677 "2016-01-07T23:36:41Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@praveerg](https://discuss.elastic.co/u/praveerg)
#### Post date: [January 7, 2016, 11:36pm UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677/1 "2016-01-07T23:36:41Z")
I need help to create a pipeline file for IBM websphere systemerr log file which has combination of single line and multiline events.
Can some help here ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 8, 2016, 7:26am UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677/2 "2016-01-08T07:26:21Z")
Without examples of what you're trying to parse I doubt someone will be able to help.
---
### Author:  [@praveerg](https://discuss.elastic.co/u/praveerg)
#### Post date: [January 8, 2016, 4:03pm UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677/3 "2016-01-08T16:03:53Z")
2015-12-14 14:46:47:345 -0800 [WebContainer : 1466] ERROR LoggerFilter - Browser no identified for User Agent
2015-12-14 14:46:15:418 -0800 [WebContainer : 1462] ERROR LoggerFilter - Browser no identified for User Agent
2015-12-14 14:46:04:297 -0800 [WebContainer : 2147] ERROR DigesterDriver - Some exception Occured in processing Data from View :
java.sql.SQLException: ORA-00904: "PROGRAM\_REBATE": invalid identifier
at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:113) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.T2CConnection.checkError(T2CConnection.java:693) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.T2CConnection.checkError(T2CConnection.java:612) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.T2CPreparedStatement.executeForDescribe(T2CPreparedStatement.java:571) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.OracleStatement.executeMaybeDescribe(OracleStatement.java:1051) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1156) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3415) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:3460) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.T2CPreparedStatement.executeQuery(T2CPreparedStatement.java) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at com.ibm.ws.rsadapter.jdbc.WSJdbcPreparedStatement.pmiExecuteQuery(WSJdbcPreparedStatement.java:1034) ~[com.ibm.ws.runtime\_6.1.0.jar:na]
at com.ibm.ws.rsadapter.jdbc.WSJdbcPreparedStatement.executeQuery(WSJdbcPreparedStatement.java:684) ~[com.ibm.ws.runtime\_6.1.0.jar:na]
at com.cisco.ccw.quoting.module.pdw.notification.DigesterDriver.getDataFromView(DigesterDriver.java:386) [classes/:na]
at com.cisco.ccw.quoting.module.pdw.notification.DigesterDriver.processDynamicColumns(DigesterDriver.java:320) [classes/:na]
at com.cisco.ccw.quoting.module.pdw.notification.DigesterDriver.processSectionVector(DigesterDriver.java:282) [classes/:na]
at com.cisco.ccw.quoting.module.pdw.notification.EmailHandler.getEmailContentsForView(EmailHandler.java:68) [classes/:na]
at com.cisco.ccw.quoting.module.pdw.notification.DigesterDriver.getHtmlContent(DigesterDriver.java:170) [classes/:na]
at com.cisco.ccw.quoting.module.pdw.notification.NotificationTemplateObject.parseToHtml(NotificationTemplateObject.java:333) [classes/:na]
at com.cisco.ccw.quoting.module.pdw.service.impl.PhaseDevationsServiceImpl.getDistiEmailAttachment(PhaseDevationsServiceImpl.java:431) [classes/:na]
at com.cisco.ccw.quoting.module.pdw.service.impl.PhaseDevationsServiceImpl.exportForAttachment(PhaseDevationsServiceImpl.java:415) [classes/:na]
at sun.reflect.GeneratedMethodAccessor6260.invoke(Unknown Source) ~[na:na]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.5.0]
at java.lang.reflect.Method.invoke(Method.java:619) ~[na:1.5.0]
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317) [spring-aop-3.2.8.RELEASE.jar:3.2.8.RELEASE]
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183) [spring-aop-3.2.8.RELEASE.jar:3.2.8.RELEASE]
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150) [spring-aop-3.2.8.RELEASE.jar:3.2.8.RELEASE]
at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:96) [spring-tx-3.2.8.RELEASE.jar:3.2.8.RELEASE]
at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:260) [spring-tx-3.2.8.RELEASE.jar:3.2.8.RELEASE]
at org.springframework.transaction.interceptor.TransactionInterceptor.inv
2015-12-14 14:46:04:279 -0800 [WebContainer : 2147] ERROR DigesterDriver - Some exception Occured in processing Data from View :
java.sql.SQLException: ORA-00904: "PROGRAM\_REBATE": invalid identifier
at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:113) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
at oracle.jdbc.driver.T2CConnection.checkError(T2CConnection.java:693) ~[ojdbc14.jar:Oracle JDBC Driver version - "10.2.0.5.0"]
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 8, 2016, 6:12pm UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677/4 "2016-01-08T18:12:10Z")
Okay, so a pretty standard Java log. It should be quite easy to find examples of how to parse very similar logs. I suggest you ignore the multiline messages for now and nail down the rest. Then bolt on multiline support, which can reuse the beginning of the grok expression.
---
### Author:  [@praveerg](https://discuss.elastic.co/u/praveerg)
#### Post date: [January 8, 2016, 7:53pm UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677/5 "2016-01-08T19:53:21Z")
Hi ,
I used the below grok to filter the single line..I m not able to parse the in b/w multiline events
```
grok {
match => { "message" => "%{GREEDYDATA:log_event_timestamp} \[%{DATA:thread_info}\] %{NOTSPACE:log_level} %{NOTSPACE:logger_name} - %{GREEDYDATA:all_text}" }
}
date {
match => ["log_event_timestamp", "yyyy-MM-dd HH:mm:ss:SSS Z"]
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 9, 2016, 3:31pm UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677/6 "2016-01-09T15:31:38Z")
To avoid surprises, don't use GREEDYDATA more than once in the same expression. Dates are easy to parse and there are several standard grok patterns for parsing them. Once you have a more exact expression for the date at the beginning of the line you can use a multiline codec or filter like this:
```auto
multiline {
pattern => "^your grok expression that matches the beginning of a line"
negate => true
what => "previous"
}
```
This means: If the current line _does not_ begin with a timestamp, join it with the previous line.
If you choose to use a multiline filter rather than a codec, make sure it precedes the grok filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/parsing-websphere-syserr-log-file-using-logstash/38677/7 "2017-07-06T05:16:16Z")