This is my json message:
{ "module":"MODULE",
"timeStamp":"Jun 22 12:20:46.785",
"containerId":INDLT1534",
"correlationId":"",
"level":"ERROR",
"logger":"c.m.r.HelloWorldService",
"message":"This is due to java.lang.ClassNotFoundException: com.org.sequent.tag
at java.net.URLClassLoader.findClass(URLClassLoader.java:381) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:424) ~[?:1.8.0_161]
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:338) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ~[?:1.8.0_161]
at java.lang.Class.forName0(Native Method) ~[?:1.8.0_161]
at java.lang.Class.forName(Class.java:264) ~[?:1.8.0_161]
at com.mkyong.rest.HelloWorldService.main(HelloWorldService.java:19) [classes/:?]
",
"exception":" java.lang.ClassNotFoundException: com.org.sequent.tag
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:338)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:264)
at com.mkyong.rest.HelloWorldService.main(HelloWorldService.java:19)
"}
`Here is my logstash.conf file:`
input {
tcp {
port => 5120
type => syslog
}
udp {
port => 5120
type => syslog
}
}
filter {
grok {
match => { "message" => " {%{QS}:%{QS:module},%{QS}:%{QS:@timestamp},%{QS}:%{QS},%{QS:}:%{QS:correlationId},%{QS}:%{QS},%{QS}:%{QS},%{QS}:%{GREEDYDATA:message},%{QS}:%{QS}}" }
overwrite => [ "message" ]
named_captures_only => true
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => line }
}
For normal logs this config is working fine but once get any error this is not working. It is creating separate entry for each line. I have tried to replace /n with " " but then logs are not readable.
Or if I replace /n with "[NEWLINE]", Is there any way on kibana to replace [NEWLINE] with actual newline only for display.