Following are my log lines:
Timestamp: 27-05-2016 13:25:17
Title:Customer.GetCustomer()
Message: Searched Customers for number : 123
InnerException: An error has occurred
StackTrace: An error has occurred
Machine: PQR
Timestamp: 27-05-2016 13:25:17
Title:Customer.GetCustomer()
Message: Searching Customers for number : 123
Machine: PQR
Timestamp: 27-05-2016 13:25:17
Title:Customer.GetCustomer()
Message: Searching Customers for number : 123
StackTrace: An error has occurred
Some exception has taken place
Machine: PQR
Fields like 'InnerException' and 'StackTrace' are optional in my log. Following is the grok pattern which I have constructed, but its not working.
'InnerException' and 'Trace' are becoming part of 'Message' field, they are not getting created as separate fields, if present in log.
(?m)%{DATESTAMP:Timestamp}\s+%{TITLE:ServiceTitle}\s+%{MESSAGE:ServiceMessage}(\s+%{IEXCEPTION:InnerException})?(\s+%{TRACE:Trace})?\s+%{MACHINE:ServiceMachine}
The extra patterns used are:
TITLE ^\s*Title:.+
MESSAGE ^\s*Message:.+
IEXCEPTION ^\s*InnerException:.+
TRACE ^\s*StackTrace:.+
MACHINE ^\s*Machine:.\S+
The multi-line filter applied is:
^\Timestamp
Negate the multi-line regex:
True
Can you please tell me, what is wrong in my grok pattern? And how 'InnerException' and 'Trace' will get created as separate fields, if present in log lines.
