Logstash configuration to modify exception stacktrace

Question

My application send log events to logstash using log4j2 socket appender and JsonLayout. In kibana I want to show all other properties in json format other than stacktrace.

log4j2.xml configuration
    <Socket host="localhost" name="mySocketAppender" port="9955">
     <JsonLayout compact="true" eventEol="true" includeStacktrace="true" properties="true
    </Socket>

logstash.config

input { 
  tcp {
    port => 9955
    codec => json
  } 
}
filter {
 date {
       match => [ "timeMillis", "UNIX_MS" ]
      }
 }
output {
   elasticsearch { hosts => ["localhost:9200"]}
}

I expect output as

Caused by: java.lang.NullPointerException
 at java.net.URLEncoder.encode(URLEncoder.java:204) ~[?:1.8.0_151]
 at com.mytestClass.service.test.generateURL(test.java:1922) ~[abc-xyz.jar:?]
 at com.mytestClass.service.test.publishURLToUsers(test.java:1847) ~[abc-xyz.jar:?]
 at com.mytestClass.service.test..publishURL(test.java:1809) ~[abc-xyz.jar:?]

but Kibana shows output for stacktrace as:

thrown.cause.extendedStackTrace   {
                                   "exact": false,
                                   "location": "?",
                                   "class": "java.net.URLEncoder",
                                   "file": "URLEncoder.java",
                                   "version": "1.8.0_151",
                                   "method": "encode",
                                   "line": 204
                                  },
                                  {
                                   "exact": false,
                                   "location": "abc-xyz.jar",
                                   "class": "com.mytestClass.service.test",
                                   "file": "test.java",
                                   "version": "?",
                                   "method": "generateURL",
                                   "line": 1922
                                   },
                                   {
                                   "exact": false,
                                   "location": "abc-xyz.jar",
                                   "class": "com.mytestClass.service.test",
                                   "file": "test.java",
                                   "version": "?",
                                   "method": "publishURLToUsers",
                                   "line": 1847
                                   },
                                   {
                                    "exact": false,
                                    "location": "abc-xyz.jar",
                                    "class": "com.mytestClass.service.test",
                                    "file": "test.java",
                                    "version": "?",
                                    "method": "publishURL",
                                    "line": 1809
                                    }

What changes should I make in logstash configuration so that all other properties in log event are displayed in json format but not exception stacktrace.

Have you tried using the [convert option of the mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert) to try to convert the field into a string? — mihomir, Jul 11 '19 at 10:11
Or alternatively don't apply a json codec in the input but instead use [the json filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html#plugins-filters-json-source) on the fields you want in json. — mihomir, Jul 11 '19 at 10:13
@mihomir Thanks for your suggestion.I tried mutate filter (mutate {convert => { "thrown.extendedStackTrace" => "string" } }) but it did not worked. — user3153309, Jul 11 '19 at 11:39

Logstash configuration to modify exception stacktrace

0 Answers0