# Why wouldn't logstash parse my java stacktrace **URL:** \ **Category:** Logstash\ **Created:** [April 19, 2019, 9:24am UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591 "2019-04-19T09:24:18Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![LI\_Bohao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_bohao/32/44438_2.png) [@LI\_Bohao](https://discuss.elastic.co/u/LI_Bohao)\ **Post date:** [April 19, 2019, 9:24am UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/1 "2019-04-19T09:24:18Z")
I have a Spring Boot application that can emits logs like this (java stacktrace) ``` 2019-04-19 09:10:45.757 ERROR [discovery,,,] 1 --- [tbeatExecutor-0] com.netflix.discovery.DiscoveryClient : DiscoveryClient_DISCOVERY/9c4a9274ab5f:discovery:8761 - was unable to send heartbeat! com.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:111) ~[eureka-client-1.6.2.jar!/:1.6.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.6.2.jar!/:1.6.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92) ~[eureka-client-1.6.2.jar!/:1.6.2] at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) ~[eureka-client-1.6.2.jar!/:1.6.2] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.6.2.jar!/:1.6.2] at com.netflix.discovery.DiscoveryClient.renew(DiscoveryClient.java:815) ~[eureka-client-1.6.2.jar!/:1.6.2] at com.netflix.discovery.DiscoveryClient$HeartbeatThread.run(DiscoveryClient.java:1379) [eureka-client-1.6.2.jar!/:1.6.2] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_202] at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_202] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_202] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_202] at java.lang.Thread.run(Thread.java:748) [na:1.8.0_202] ``` I use ELK Stack to view these logs. I can see events coming in Logstash by typing "`docker logs logstash`" (I running logstash in docker): `09:10:45.775 [[main]>worker7] DEBUG logstash.pipeline - filter received {"event"=>{"@timestamp"=>2019-04-19T09:10:45.769Z, "stream"=>"stdout", "port"=>36238, "@version"=>"1", "host"=>"172.18.0.3", "message"=>"\ncom.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server\n\tat com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:111) ~[eureka-client-1.6.2.jar!/:1.6.2]\n\tat com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.6.2.jar!/:1.6.2]\n\tat com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92) ~[eureka-client-1.6.2.jar!/:1.6.2]\n\tat com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) ~[eureka-client-1.6.2.jar!/:1.6.2]\n\tat com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.6.2.jar!/:1.6.2]\n\tat com.netflix.discovery.DiscoveryClient.renew(DiscoveryClient.java:815) ~[eureka-client-1.6.2.jar!/:1.6.2]\n\tat com.netflix.discovery.DiscoveryClient$HeartbeatThread.run(DiscoveryClient.java:1379) [eureka-client-1.6.2.jar!/:1.6.2]\n\tat java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_202]\n\tat java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_202]\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_202]\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_202]\n\tat java.lang.Thread.run(Thread.java:748) [na:1.8.0_202]", "type"=>"logspout-logs-tcp", "docker"=>{"name"=>"/universign-ng_discovery-master2_1", "image"=>"universign/discovery-server:1.4-SNAPSHOT", "hostname"=>"9c4a9274ab5f", "id"=>"9c4a9274ab5fa643642d8804cd1d4e1629ac754e65367081f34a55a1d8eba1ae", "labels"=>nil}, "tags"=>["docker-universign-ng", "dev-dc0-lap-57.universign.net"]}}` I defined grok in logstash like this: ``` grok { match => { "message" => [ "\n(?.*?Exception: .*+\n(\sat.*+\n)*+)" ] } } ``` But in Kibana I see that this log has a grokParseFailure, like this: ![Capture%20d'%C3%A9cran%20de%202019-04-19%2011-28-28](https://us1.discourse-cdn.com/elastic/original/3X/e/d/edc3b9f555cb7614e036ddd3e1e2fdd613fa9300.png) So why can't logstash properly parse my java stacktrace ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 19, 2019, 3:01pm UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/2 "2019-04-19T15:01:20Z")
What do you expect .\*+ to match? ---
**Author:** ![LI\_Bohao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_bohao/32/44438_2.png) [@LI\_Bohao](https://discuss.elastic.co/u/LI_Bohao)\ **Post date:** [April 23, 2019, 8:21am UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/3 "2019-04-23T08:21:16Z")
I used [this page](http://grokdebug.herokuapp.com/) to test logs against grok pattern, and it passed. ---
**Author:** ![LI\_Bohao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_bohao/32/44438_2.png) [@LI\_Bohao](https://discuss.elastic.co/u/LI_Bohao)\ **Post date:** [April 23, 2019, 8:28am UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/4 "2019-04-23T08:28:56Z")
I expect .\*+ to match all characters (except new line) after a cetrain word, like "at", "caused by" ... ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 23, 2019, 11:27am UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/5 "2019-04-23T11:27:11Z")
- and \* are both modifiers of the previous character. . matches any character, + says to match it one or more times, \* says to match it zero or more times. So .\* and .+ both make sense, but .\*+ does not. I am not sure what it matches, but probably any group of characters followed by + ---
**Author:** ![LI\_Bohao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_bohao/32/44438_2.png) [@LI\_Bohao](https://discuss.elastic.co/u/LI_Bohao)\ **Post date:** [April 23, 2019, 12:03pm UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/6 "2019-04-23T12:03:47Z")
On the official page of logstash, it says that it uses [oniguruma](http://oniguruma) regex syntax, and \*+ means possesive quantifier. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 23, 2019, 12:17pm UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/7 "2019-04-23T12:17:48Z")
I stand corrected. ``` "\n(?.*?Exception: .+\n(\sat.*+\n)*+)" ``` works, although it does not capture the final line of the stack trace. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 21, 2019, 12:17pm UTC](https://discuss.elastic.co/t/why-wouldnt-logstash-parse-my-java-stacktrace/177591/8 "2019-05-21T12:17:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.