# What analyzer to use in mappings for java stack traces

**URL:** <https://discuss.elastic.co/t/what-analyzer-to-use-in-mappings-for-java-stack-traces/75816>\
**Category:** Elasticsearch\
**Created:** [February 21, 2017, 4:20am UTC](https://discuss.elastic.co/t/what-analyzer-to-use-in-mappings-for-java-stack-traces/75816 "2017-02-21T04:20:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SKumarMN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skumarmn/32/27537_2.png) [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\
**Post date:** [February 21, 2017, 4:20am UTC](https://discuss.elastic.co/t/what-analyzer-to-use-in-mappings-for-java-stack-traces/75816/1 "2017-02-21T04:20:00Z")

</div>

Hi,

I have a use case for logging the java stack traces to ES and the end user to search for error patterns. I would be using filebeat to ship my stack traces as a single event using the multi line configuration. Say if my log is as below,  
what would be the ideal recommended mapping so that user should be able to search either using "org.elasticsearch.transport.BindTransportException" or "BindTransportException" or (NettyTransport.java:402) etc...

org.elasticsearch.transport.BindTransportException: Failed to resolve host [null]  
at org.elasticsearch.transport.netty.NettyTransport.bindServerBootstrap(NettyTransport.java:402)  
at org.elasticsearch.transport.netty.NettyTransport.doStart(NettyTransport.java:283)  
at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:85)  
at org.elasticsearch.transport.TransportService.doStart(TransportService.java:153)  
at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:85)  
at org.elasticsearch.node.internal.InternalNode.start(InternalNode.java:257)  
at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:160)  
at org.elasticsearch.bootstrap.Bootstrap.main(Bootstrap.java:248)  
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:32)  
Caused by: java.net.UnknownHostException: incorrect\_hostname: unknown error

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 21, 2017, 4:41am UTC](https://discuss.elastic.co/t/what-analyzer-to-use-in-mappings-for-java-stack-traces/75816/2 "2017-02-21T04:41:00Z")

</div>

You would be better off using Logstash for this.

---

<div class="post-metadata">

**Author:** ![SKumarMN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skumarmn/32/27537_2.png) [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\
**Post date:** [February 21, 2017, 6:38am UTC](https://discuss.elastic.co/t/what-analyzer-to-use-in-mappings-for-java-stack-traces/75816/3 "2017-02-21T06:38:11Z")

</div>

Thanks for your reply.

My question is what should be the mapping in elasticsearch . i .e the analyzer for this field having logging messages

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2017, 6:38am UTC](https://discuss.elastic.co/t/what-analyzer-to-use-in-mappings-for-java-stack-traces/75816/4 "2017-03-21T06:38:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.