Want to get only the java.language.class of the Exception in my stacktrace into a field of kibana

[dzoni]

Hello,

i'm trying to create a Dashboard to monitor the thrown Exceptions of my Java application.

In Kibana I have the full Information of the whole stacktrace as a field.

When i create now a new visualization with the term Aggregation i will get the amount of each different thrown exception.

But i will aggregate all NullPointer, Runtime, etc. in one Bucket.

Where i have to configure my case to get a field, where only the Java.language.class of the Exception will be?

My case:
Logging-framework: slf4j
Elasticsearch 7.6
Kibana 7.6
I'm getting my log-message with the Karaf Decanter directly into elasticsearch.
In my case i'm not allowed to use Logstash.

I will be happy if anyone can help me to find a solution.
Thanks a lot

Greeting

[flash1293 (Joe Reuter)]

If you can't use Logstash, you can also define an ingest pipeline within Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html

There you can use a script to pull the class of an exception into a separate field so you can aggregate properly.

If that's also out of question, you can also use a scripted field within Kibana to do the same thing at query time.

However, I strongly recommend using the ingest pipeline approach, because the performance of the latter approach will likely be orders of magnitude worse than the first one, depending on your data volume. It's mostly helpful to quickly prototype and check whether your script works the way you intended before setting up the pipeline for the production workload.