Stacktrace logged by several lines in kibana

[ANARAN]

Hello,

I'm trying to improve the display of stacktraces for an application I'm working on.

Now, the stacktrace look like this :

I work with log4j (I know, it's deprecated) and logstash, but not filebeat.

How can I improve the display of the log in an only message ?

Here is a sample of my portal-log4-ext.xml :

<appender name="SocketAppender" class="org.apache.log4j.net.SocketAppender">
        <param name="Port" value="6812"/>
        <param name="RemoteHost" value="localhost"/>
        <param name="ReconnectionDelay" value="1000" />
        <param name="Application" value="censured"/>
    </appender>
    <appender name="AsyncAppender" class="org.apache.log4j.AsyncAppender">
        <param name="Blocking" value="false"/>
        <param name="BufferSize" value="1024"/>
        <appender-ref ref="SocketAppender"/>
    </appender>

thanks by advance for your replies.

[carly.richmond]

Hi @ANARAN,

Welcome to the community! Can you explain what you mean by improve the display of your log messages? Can you give us an example of the output you want to see?

[ANARAN]

Hello,

I can't give another sample. I'm afraid to reveal information about my company.

I can discribe what I'd like to get :

Instead of seeing the whole stacktrace cut by several lines in kibana, I would like to get an only message for the message.
This message will start with the error message (like in the image I gave : "com.liferay.portal.kernel.security.auth.AuthException").
Then you can see in kibana you could deploy the message caracteristics and display details about the message. There you could see the whole stacktrace.

I saw it in another project, but I can't find an example with log4j 1 . Do you have any clue ?

[leandrojmp (Leandro Pereira)]

If you are sending this to Logstash you need to have a multiline codec in your input.

Check the documentation for some examples.

You need to solve this in Logstash, before sending the data to Elasticsearch, and for multiline logs like that one you need to use the multiline codec.

But without any sample of your data is pretty hard to help further with working examples.