logstash multline issue with java logs

Vote count:

0

I am installing logsash with tomcat and having issue to grab java stack trace call, following is my config

input   {
 udp {
   type => "tomcat"
   port => "514"
   format => "plain"

 }

}

filter{
multiline {
            pattern => "(^.+Exception.*)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
            what => "previous"
}
}

Here is sample logs of tomcat

2014-03-24 19:08:53,246 [thread-pool8] ERROR org.apache.catalina.core.ContainerBase.[engine].[localhost] - Exception Processing ErrorPage[errorCode=500, location=/error/error500.jsp]
org.apache.jasper.JasperException: java.lang.NullPointerException
        at org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:549)
        at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:470)
        at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:390)
        at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
        at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:749)
        at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:489)
        at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:412)
        at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:339)
        at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:467)
        at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:338)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:203)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1023)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1686)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:744)
Caused by: java.lang.NullPointerException
        at org.apache.jsp.error.error500_jsp._jspService(error500_jsp.java:266)
        at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
        at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:432)
        ... 21 more

I have tired all combination and none of work :( i don't know how it works for other folks..

asked 2 mins ago

Satish

2,962