Graylog 合并多行 Java Error 日志

1、线上运行的 java 服务输出的 error 日志格式为（以其中2条日志记录作示例）

[tx-web-fms]2018-12-03 09:52:00,007 CST ERROR com.alibaba.druid.filter.logging.Slf4jLogFilter 149 statementLogError - {conn-10205, stmt-26304} execute error. SELECT 1 com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure

The last packet successfully received from the server was 1,199,997 milliseconds ago.  The last packet sent successfully to the server was 1,199,998 milliseconds ago.
    at sun.reflect.GeneratedConstructorAccessor96.newInstance(Unknown Source) ~[?:?]
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:1.8.0_181]
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[?:1.8.0_181]
    at com.mysql.jdbc.Util.handleNewInstance(Util.java:377) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.SQLError.createCommunicationsException(SQLError.java:1036) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.MysqlIO.send(MysqlIO.java:3661) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2417) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2582) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2526) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2484) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1446) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.alibaba.druid.filter.FilterChainImpl.statement_executeQuery(FilterChainImpl.java:2363) ~[druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterAdapter.statement_executeQuery(FilterAdapter.java:2481) ~[druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterEventAdapter.statement_executeQuery(FilterEventAdapter.java:302) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.statement_executeQuery(FilterChainImpl.java:2360) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterAdapter.statement_executeQuery(FilterAdapter.java:2481) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterEventAdapter.statement_executeQuery(FilterEventAdapter.java:302) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.statement_executeQuery(FilterChainImpl.java:2360) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.proxy.jdbc.StatementProxyImpl.executeQuery(StatementProxyImpl.java:211) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.ValidConnectionCheckerAdapter.isValidConnection(ValidConnectionCheckerAdapter.java:44) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidAbstractDataSource.testConnectionInternal(DruidAbstractDataSource.java:1298) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnectionDirect(DruidDataSource.java:1054) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.dataSource_connect(FilterChainImpl.java:4544) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.logging.LogFilter.dataSource_getConnection(LogFilter.java:831) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.dataSource_connect(FilterChainImpl.java:4540) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.stat.StatFilter.dataSource_getConnection(StatFilter.java:662) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.dataSource_connect(FilterChainImpl.java:4540) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:992) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:984) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:103) [druid-1.0.25.jar:1.0.25]
    at org.springframework.jdbc.datasource.DataSourceTransactionManager.doBegin(DataSourceTransactionManager.java:204) [spring-jdbc-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.support.AbstractPlatformTransactionManager.getTransaction(AbstractPlatformTransactionManager.java:373) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.interceptor.TransactionAspectSupport.createTransactionIfNecessary(TransactionAspectSupport.java:427) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:276) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) [spring-aop-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:207) [spring-aop-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at com.sun.proxy.$Proxy86.synRefundBondStatus(Unknown Source) [?:?]
    at com.tx.web.fms.service.elastic.SynRefundBondStatusJob.execute(SynRefundBondStatusJob.java:23) [classes/:?]
    at com.dangdang.ddframe.job.executor.type.SimpleJobExecutor.process(SimpleJobExecutor.java:41) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.process(AbstractElasticJobExecutor.java:206) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.process(AbstractElasticJobExecutor.java:171) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.execute(AbstractElasticJobExecutor.java:150) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.execute(AbstractElasticJobExecutor.java:122) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.lite.internal.schedule.LiteJob.execute(LiteJob.java:26) [elastic-job-lite-core-2.1.5.jar:?]
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202) [quartz-2.2.1.jar:?]
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573) [quartz-2.2.1.jar:?]
Caused by: java.net.SocketException: Connection reset
    at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:115) ~[?:1.8.0_181]
    at java.net.SocketOutputStream.write(SocketOutputStream.java:155) ~[?:1.8.0_181]
    at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) ~[?:1.8.0_181]
    at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140) ~[?:1.8.0_181]
    at com.mysql.jdbc.MysqlIO.send(MysqlIO.java:3643) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    ... 41 more

[tx-web-fms]2018-12-03 16:32:00,008 CST ERROR com.alibaba.druid.filter.logging.Slf4jLogFilter 149 statementLogError - {conn-10203, stmt-26390} execute error. SELECT 1 com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure

The last packet successfully received from the server was 1,199,996 milliseconds ago.  The last packet sent successfully to the server was 1,199,996 milliseconds ago.
    at sun.reflect.GeneratedConstructorAccessor94.newInstance(Unknown Source) ~[?:?]
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:1.8.0_181]
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[?:1.8.0_181]
    at com.mysql.jdbc.Util.handleNewInstance(Util.java:377) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.SQLError.createCommunicationsException(SQLError.java:1036) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.MysqlIO.send(MysqlIO.java:3661) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2417) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2582) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2526) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2484) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1446) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    at com.alibaba.druid.filter.FilterChainImpl.statement_executeQuery(FilterChainImpl.java:2363) ~[druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterAdapter.statement_executeQuery(FilterAdapter.java:2481) ~[druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterEventAdapter.statement_executeQuery(FilterEventAdapter.java:302) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.statement_executeQuery(FilterChainImpl.java:2360) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterAdapter.statement_executeQuery(FilterAdapter.java:2481) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterEventAdapter.statement_executeQuery(FilterEventAdapter.java:302) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.statement_executeQuery(FilterChainImpl.java:2360) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.proxy.jdbc.StatementProxyImpl.executeQuery(StatementProxyImpl.java:211) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.ValidConnectionCheckerAdapter.isValidConnection(ValidConnectionCheckerAdapter.java:44) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidAbstractDataSource.testConnectionInternal(DruidAbstractDataSource.java:1298) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnectionDirect(DruidDataSource.java:1054) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.dataSource_connect(FilterChainImpl.java:4544) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.logging.LogFilter.dataSource_getConnection(LogFilter.java:831) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.dataSource_connect(FilterChainImpl.java:4540) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.stat.StatFilter.dataSource_getConnection(StatFilter.java:662) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.filter.FilterChainImpl.dataSource_connect(FilterChainImpl.java:4540) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:992) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:984) [druid-1.0.25.jar:1.0.25]
    at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:103) [druid-1.0.25.jar:1.0.25]
    at org.springframework.jdbc.datasource.DataSourceTransactionManager.doBegin(DataSourceTransactionManager.java:204) [spring-jdbc-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.support.AbstractPlatformTransactionManager.getTransaction(AbstractPlatformTransactionManager.java:373) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.interceptor.TransactionAspectSupport.createTransactionIfNecessary(TransactionAspectSupport.java:427) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:276) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) [spring-tx-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) [spring-aop-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:207) [spring-aop-4.2.0.RELEASE.jar:4.2.0.RELEASE]
    at com.sun.proxy.$Proxy37.synAcWithdrawStatus(Unknown Source) [?:?]
    at com.tx.web.fms.service.elastic.SynAcWithdrawStatusJob.execute(SynAcWithdrawStatusJob.java:23) [classes/:?]
    at com.dangdang.ddframe.job.executor.type.SimpleJobExecutor.process(SimpleJobExecutor.java:41) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.process(AbstractElasticJobExecutor.java:206) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.process(AbstractElasticJobExecutor.java:171) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.execute(AbstractElasticJobExecutor.java:150) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.executor.AbstractElasticJobExecutor.execute(AbstractElasticJobExecutor.java:122) [elastic-job-common-core-2.1.5.jar:?]
    at com.dangdang.ddframe.job.lite.internal.schedule.LiteJob.execute(LiteJob.java:26) [elastic-job-lite-core-2.1.5.jar:?]
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202) [quartz-2.2.1.jar:?]
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573) [quartz-2.2.1.jar:?]
Caused by: java.net.SocketException: Connection reset
    at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:115) ~[?:1.8.0_181]
    at java.net.SocketOutputStream.write(SocketOutputStream.java:155) ~[?:1.8.0_181]
    at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) ~[?:1.8.0_181]
    at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140) ~[?:1.8.0_181]
    at com.mysql.jdbc.MysqlIO.send(MysqlIO.java:3643) ~[mysql-connector-java-5.1.34.jar:5.1.34]
    ... 41 more

2、graylog 配置 filebeat 的多行匹配规则

查看生成的规则

3、测试是否成功

可以看到已经成功合并了多行 java error 日志

4、filebeat 参数说明

multiline:
  match: after
  negate: true
  pattern: ^\[tx

multiline.pattern: 设置行的匹配字段
multiline.negate: 设置符合上面匹配条件的的行，是否应该被合并成一条日志。默认是 false，匹配 pattern 的行合并到上一行；true，不匹配 pattern 的行合并到上一行
multiline.match: 设置符合 pattern 的行应该被合并到之前不符合 pattern 的行，还是之后不符合 pattern 的行

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 214,922评论 6赞 497
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 91,591评论 3赞 389
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 160,546评论 0赞 350
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 57,467评论 1赞 288
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 66,553评论 6赞 386
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 50,580评论 1赞 293
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 39,588评论 3赞 414
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 38,334评论 0赞 270
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 44,780评论 1赞 307
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 37,092评论 2赞 330
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 39,270评论 1赞 344
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 34,925评论 5赞 338
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 40,573评论 3赞 322
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 31,194评论 0赞 21
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 32,437评论 1赞 268
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 47,154评论 2赞 366
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 44,127评论 2赞 352

Graylog 合并多行 Java Error 日志

推荐阅读更多精彩内容