# Want to group "Error message", "cause by" and "exception class" from stack trace

**URL:** <https://discuss.elastic.co/t/want-to-group-error-message-cause-by-and-exception-class-from-stack-trace/129134>\
**Category:** Logstash\
**Created:** [April 23, 2018, 2:37pm UTC](https://discuss.elastic.co/t/want-to-group-error-message-cause-by-and-exception-class-from-stack-trace/129134 "2018-04-23T14:37:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amankumbare](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@amankumbare](https://discuss.elastic.co/u/amankumbare)\
**Post date:** [April 23, 2018, 2:37pm UTC](https://discuss.elastic.co/t/want-to-group-error-message-cause-by-and-exception-class-from-stack-trace/129134/1 "2018-04-23T14:37:19Z")

</div>

Sample Input data  
2016-09-21 09:59:51,577] ERROR fetching topic metadata for topics [Set(test)] from broker [ArrayBuffer(BrokerEndPoint(2,[kafka.example.com](http://kafka.example.com),9092), BrokerEndPoint(3,[kafka.example.com](http://kafka.example.com),9092), BrokerEndPoint(0,[kafka.example.com](http://kafka.example.com),9092), BrokerEndPoint(1,[kafka.example.com](http://kafka.example.com),9092))] failed (kafka.utils.CoreUtils$)  
kafka.common.KafkaException: fetching topic metadata for topics [Set(test)] from broker [ArrayBuffer(BrokerEndPoint(2,[kafka.example.com](http://kafka.example.com),9092), BrokerEndPoint(3,[kafka.example.com](http://kafka.example.com),9092), BrokerEndPoint(0,[kafka.example.com](http://kafka.example.com),9092), BrokerEndPoint(1,kafka.example.com9092))] failed  
at kafka.client.ClientUtils$.fetchTopicMetadata(ClientUtils.scala:73)  
at kafka.producer.BrokerPartitionInfo.updateInfo(BrokerPartitionInfo.scala:82)  
at kafka.producer.async.DefaultEventHa  
Caused by: java.nio.channels.ClosedChannelException  
at kafka.network.BlockingChannel.send(BlockingChannel.scala:122)  
at kafka.producer.SyncProducer.liftedTree1$1(SyncProducer.scala:77)  
at kafka.producer.SyncProducer.kafka$producer$SyncProducer$$doSend(SyncProducer.scala:76)

I have created few custom pattern using which I am matching Error|WARN|FATAL messages. Now each FATAL log is followed by exceptionclass:data and caused by : class:data.

From above example I want to group 🙂

1. 2016-09-21 09:59:51,577] ERROR fetching topic metadata for topics [Set(test)] from broker [ArrayBuffer(BrokerEndPoint(2,[kafka.example.com](http://kafka.example.com),9092),

2. kafka.common.KafkaException: fetching topic metadata for topics [Set(test)] from broker [ArrayBuffer(BrokerEndPoint(2,kafka.example.com9092),

3. Caused by: java.nio.channels.ClosedChannelException: connectionerror

I am thinking of using a global variable for ex id =100, so every time it matches all patterns in sequence it will add tag id = 100  
In this way I can group with id.

Any help or workaround

---

<div class="post-metadata">

**Author:** ![amankumbare](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@amankumbare](https://discuss.elastic.co/u/amankumbare)\
**Post date:** [April 23, 2018, 2:43pm UTC](https://discuss.elastic.co/t/want-to-group-error-message-cause-by-and-exception-class-from-stack-trace/129134/2 "2018-04-23T14:43:50Z")

</div>

As of now output which I get is

```
cat Desktop/causedbytg.csv
java.io.IOException,Read-only file system
java.io.IOException,Disk full 

cat Desktop/exceptiontg.csv
java.io.IOException, Read-only file system
kafka.common.KafkaStorageException, I/O exception in append to log 'jsonProd3-70

cat Desktop/errortg.csv
"2017-02-12 05:21:45,495",Uncaught exception in scheduled task 'kafka-recovery-point-checkpoint' (kafka.utils.KafkaScheduler),ERROR
"2017-02-12 05:21:45,496",[Replica Manager on Broker 1]: Halting due to unrecoverable I/O error while handling produce request: (kafka.server.ReplicaManager),FATAL

```

The problem here I am unable to map Error message causedby and exception class.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2018, 2:43pm UTC](https://discuss.elastic.co/t/want-to-group-error-message-cause-by-and-exception-class-from-stack-trace/129134/3 "2018-05-21T14:43:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.