Stack-trace issue

Elastic Stack Logstash
1

This is my json message:
{ "module":"MODULE",
"timeStamp":"Jun 22 12:20:46.785",
"containerId":INDLT1534",
"correlationId":"",
"level":"ERROR",
"logger":"c.m.r.HelloWorldService",
"message":"This is due to java.lang.ClassNotFoundException: com.org.sequent.tag
at java.net.URLClassLoader.findClass(URLClassLoader.java:381) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:424) ~[?:1.8.0_161]
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:338) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ~[?:1.8.0_161]
at java.lang.Class.forName0(Native Method) ~[?:1.8.0_161]
at java.lang.Class.forName(Class.java:264) ~[?:1.8.0_161]
at com.mkyong.rest.HelloWorldService.main(HelloWorldService.java:19) [classes/:?]
",
"exception":" java.lang.ClassNotFoundException: com.org.sequent.tag
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:338)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:264)
at com.mkyong.rest.HelloWorldService.main(HelloWorldService.java:19)
"}

`Here is my logstash.conf file:`
input {
  tcp {
    port => 5120
    type => syslog
  }
  udp {
    port => 5120
    type => syslog
  }
}
filter {
  grok {
   match => { "message" => " {%{QS}:%{QS:module},%{QS}:%{QS:@timestamp},%{QS}:%{QS},%{QS:}:%{QS:correlationId},%{QS}:%{QS},%{QS}:%{QS},%{QS}:%{GREEDYDATA:message},%{QS}:%{QS}}" }
    overwrite => [ "message" ]
    named_captures_only => true
  }
}
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => line }
}

For normal logs this config is working fine but once get any error this is not working. It is creating separate entry for each line. I have tried to replace /n with " " but then logs are not readable.
Or if I replace /n with "[NEWLINE]", Is there any way on kibana to replace [NEWLINE] with actual newline only for display.

2

Hi Vishal,

Could you format the question to make it more readable?

3

Please check now.

4

Thank you!

There is no way to replace a newline just for display in Kibana. The only way the parser can work is if you account for the newline using something like gsub, which I believe you have already tried.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub

5

So can we do any change in lostash.conf so that it will allow multline logs as one message?

6

Yes, you will have to replace the newline "/n" with a space using gsub mentioned earlier.

7

but that message is not in readable format.

8

What do you mean by readable format? Could you show the message?