Skip to content

Instantly share code, notes, and snippets.

@saleeema
Created February 19, 2015 17:17
Show Gist options
  • Save saleeema/e480ae72fa431bee2a1f to your computer and use it in GitHub Desktop.
Save saleeema/e480ae72fa431bee2a1f to your computer and use it in GitHub Desktop.
Logstash grok multiline; Java stack trace
input {
file {
path => "/root/mult.log"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline{
pattern => "^ -%{SPACE}%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
}
}
filter {
grok {
match => [
"message", "(?m)^ -%{SPACE}%{TIMESTAMP_ISO8601:time} \[%{WORD:main}\] %{LOGLEVEL:loglevel}%{SPACE}\(%{JAVACLASS:class}\) %{DATA:mydata}\n(\t)?%{GREEDYDATA:stack}",
"message", "^ -%{SPACE}%{TIMESTAMP_ISO8601:time} \[%{WORD:main}\] %{LOGLEVEL:loglevel}%{SPACE}\(%{JAVACLASS:class}\) %{GREEDYDATA:mydata}" ]
break_on_match => false
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
stdout { codec => rubydebug}
elasticsearch {
host => "localhost"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment