# Problem with java stacktaces

**URL:** <https://discuss.elastic.co/t/problem-with-java-stacktaces/137415>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 26, 2018, 10:27am UTC](https://discuss.elastic.co/t/problem-with-java-stacktaces/137415 "2018-06-26T10:27:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kubson](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@Kubson](https://discuss.elastic.co/u/Kubson)\
**Post date:** [June 26, 2018, 10:27am UTC](https://discuss.elastic.co/t/problem-with-java-stacktaces/137415/1 "2018-06-26T10:27:48Z")

</div>

Hello,  
there is possibility to join java error stacktrace to above log line?

 ![2018-06-26%2012_17_15](https://us1.discourse-cdn.com/elastic/original/3X/1/2/12cab156827fa81e89306b4af85433947c4c9d87.png)

I'm totally don't know what i need to change. Below is my configuration of multiline codec from filebeat.yml and also grok filter from logstash

**filebeat.yml**

```
filebeat.prospectors:
    - 
      paths:
        - D:\Programs\jboss-eap-7.0\lines\line-AMDEV\log\saso-core-test-pl.log
      tags: ["DEV PLD PL"]
      multiline.pattern: '^[[:space:]]+(org|\.{3})\b|^Caused by:'
      multiline.negate: false
      multiline.match: after

```

**logstash conf file**

```
        filter {
        	
        	grok {
        			match => {"message" => "(?<log_timestamp>%{YEAR}-%{MONTHNUM2}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND},%{NONNEGINT})\] %{LOGLEVEL:loglevel} * \[(?<logger>[A-Za-z0-9$_.]+)\] \(%{JAVAFILE:class}:%{NONNEGINT:line}\) \[(?<thread>.*)\] \{(?<MDC>.*)\}: %{GREEDYDATA:log_message}"}
        		}
        	
        	date {
        		match => ["log_timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
        		target => "@timestamp"
        		timezone => "UTC"
        	}
        		
        	mutate {
        		remove_tag => ["beats_input_codec_plain_applied"]
        		remove_field => "timestamp"
        	}

        }

```

I'm really want to understand what is wrong with my configuration... ☹

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [June 26, 2018, 2:40pm UTC](https://discuss.elastic.co/t/problem-with-java-stacktaces/137415/2 "2018-06-26T14:40:35Z")

</div>

Hello @Kubson in our [documentation](https://www.elastic.co/guide/en/beats/filebeat/master/multiline-examples.html) we do provide a configuration to join java stack trace on Filebeat. The pattern should work in your case since new statement always starts with `[`, after your grok should work with the merged data.

```auto
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after

```

---

<div class="post-metadata">

**Author:** ![Kubson](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@Kubson](https://discuss.elastic.co/u/Kubson)\
**Post date:** [June 29, 2018, 8:03am UTC](https://discuss.elastic.co/t/problem-with-java-stacktaces/137415/3 "2018-06-29T08:03:14Z")

</div>

Hello @pierhugues, thank a lot. After few tests is works like it is described in documentation. I used this configuration before but it didn't worked, maybe i've made a small misspelling. Anyway thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2018, 8:03am UTC](https://discuss.elastic.co/t/problem-with-java-stacktaces/137415/4 "2018-07-27T08:03:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.