Logstash合并java多行日志异常

读取java日志中，异常日志必不可少，但是在elasticsearch展示要合并成多行。下面是操作步骤。

日志准备

[2016-11-01 16:48:24,946] [ERROR] c.b.t.biz.back.billing.BillingBiz 200 -- [f8b9e646-363e-4976-ac83-944a99e159ac] failed transferFee EXCEPTION :c.b.t.m.common.exception.FrontParamException: 错误码:BILLING_FAILED, 为什么不行
        at com.b.tradefront.biz.back.billing.handle.BillingHandle.fee(BillingHandle.java:58)
        at com.b.tradefront.biz.back.billing.BillingBiz.transferFee(BillingBiz.java:188)
        at com.b.tradefront.biz.common.dispatch.trans.TransferCoreBiz.transfer(TransferCoreBiz.java:69)
        at com.b.tradefront.biz.common.dispatch.TransferProcess.doCmd(TransferProcess.java:54)
        at com.b.tradefront.manager.common.dispatch.impl.BaseCmdHandler.execute(BaseCmdHandler.java:60)
        at sun.reflect.GeneratedMethodAccessor203.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208)
        at com.sun.proxy.$Proxy53.execute(Unknown Source)
        at com.b.tradefront.manager.common.dispatch.HandlerWrapper.run(HandlerWrapper.java:27)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
[2016-11-01 16:48:24,947] [ERROR] c.b.t.b.b.b.b 200 -- [f8b9e646-363e-4976-ac83-944a99e159ac] failed transferFee EXCEPTION :我是不用换行的日志

使用multiline，直接运行：

bin/logstash -e 'input{
    stdin{}
}
filter {
    multiline {
        pattern => "^\s" 
        what => "previous"
        }
}
output{
    stdout{codec=>rubydebug}
}'

返回

{
       "message" => "[2016-11-01 16:48:24,946] [ERROR] c.b.t.biz.back.billing.BillingBiz 200 -- [f8b9e646-363e-4976-ac83-944a99e159ac] failed transferFee EXCEPTION :c.b.t.m.common.exception.FrontParamException: 错误码:BILLING_FAILED\n        at com.b.tradefront.biz.back.billing.handle.BillingHandle.fee(BillingHandle.java:58)\n        at com.b.tradefront.biz.back.billing.BillingBiz.transferFee(BillingBiz.java:188)\n        at com.b.tradefront.biz.common.dispatch.trans.TransferCoreBiz.transfer(TransferCoreBiz.java:69)\n        at com.b.tradefront.biz.common.dispatch.TransferProcess.doCmd(TransferProcess.java:54)\n        at com.b.tradefront.manager.common.dispatch.impl.BaseCmdHandler.execute(BaseCmdHandler.java:60)\n        at sun.reflect.GeneratedMethodAccessor203.invoke(Unknown Source)\n        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n        at java.lang.reflect.Method.invoke(Method.java:498)\n        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)\n        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)\n        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)\n        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)\n        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281)\n        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)\n        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)\n        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208)\n        at com.sun.proxy.$Proxy53.execute(Unknown Source)\n        at com.b.tradefront.manager.common.dispatch.HandlerWrapper.run(HandlerWrapper.java:27)\n        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\n        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\n        at java.lang.Thread.run(Thread.java:745)",
      "@version" => "1",
    "@timestamp" => "2016-11-04T02:54:58.140Z",
          "host" => "linux21-49",
          "tags" => [
        [0] "multiline"
    ]
}
{
       "message" => "[2016-11-01 16:48:24,947] [ERROR] c.b.t.b.b.b.b 200 -- [f8b9e646-363e-4976-ac83-944a99e159ac] failed transferFee EXCEPTION :我是不用换行的日志",
      "@version" => "1",
    "@timestamp" => "2016-11-04T02:54:59.315Z",
          "host" => "linux21-49"
}

已经成功了。

参考官网：https://www.elastic.co/guide/en/logstash/current/plugins-filters-multiline.html