Java stacktrace 的多行解析仅提取几行 | Elasticsearch

Question

Current filebeat.yml parameters are like below:

- type: log
  paths:
    - /tmp/test.log
  pipeline: filebeat-test-java-logs
  enabled: true
  multiline.pattern: ^\d{4}-\d{2}-\d{2}
  multiline.negate: true
  multiline.match: after
  multiline.timeout: 300s

We have a new setup to parse the java stacktrace but the msg part is showing up only fewer lines of the error (say upto 2-4 lines) and not displaying the whole error from the log file.

While we got a relative output when tried to write it to a file in the server itself but while redirecting the same to logstash yielded no outputs at the msg part.

Any help would be appreciated.

Answer 1

For the filed type concern, we have now changed the field type to "text" and have updated the Index and search analyzer to "simple" which is helping us to fetch the results completely.