multiline - separate field / array fields


Hey, i currently work on parsing a PHP error log file.
Logstash is working great but i have some trouble with stacktraces.

I'm able to add the stacktrace to the error itself using the multiline filter. But it will be great to have those lines in extra fields.
For now, i can parse the error itself (exclude file, line, ...) but i have to parse the @message with another tool to extract the stacktrace.

I can parse the stacktrace lines too, but logstash only saves one value per field.

For example, i have a stacktrace with 4 lines (4 different functions were called, in 4 different files) i want to extract the 4 files, 4 functions, 4 linenumbers ...

Maybe its possible to add a easy array syntax:

-> this will add all methods into an array

Is that possible?


Philippe Weber
May 1, 2013, 11:55 AM

If I understand you well, you can already do this by using a grok before your multiline.

By "appending" events, the multiline will concatenate the different value in the "method" field, giving you an array.
Only catch situation, it only add new value to the field, avoiding duplicate like a set.

Alex Adam
May 1, 2013, 1:16 PM

Thats great! Thanks a lot, it works perfect.
The more i use logstash, the more i love it

Alex Adam
May 1, 2013, 3:45 PM

Is there a way to get duplicates in this array?
For example, if i have a stacktrace like this:

And i parse it with this:

I will get an array with 2 file names as stacktrace_file so it will be hard to use that later.
The only way i see is, use file and line together and split that later.


Logstash Developers


Alex Adam


Affects versions