如何在Java中用Regex提取嵌套异常的4-5行异常信息

Hey Kapil, no stress at all—even without seeing your actual stack trace, we can build a solid solution for extracting those nested exception lines and getting them into Kibana via Logstash. Let's walk through this step by step, since regex (and Logstash's tools) can feel overwhelming at first.

First, you need to make sure Logstash treats the entire nested exception stack as a single event. Otherwise, each line of the stack will be a separate entry, which makes extraction impossible. Use the multiline codec in your input to group these lines:

input {
  # Replace this with your actual input (e.g., Filebeat, file input)
  file {
    path => "/var/log/your_app_errors.log"
    codec => multiline {
      # Match lines that start with an exception type or "Caused by:" (adjust if your exceptions use different keywords)
      pattern => "^[A-Za-z]+Exception|^Caused by:"
      negate => false
      what => "previous"
    }
  }
}

This will glue all related exception lines into one message field in Logstash.

Since you're new to regex, using a Ruby filter in Logstash is more flexible and easier to adjust than pure regex. It lets you explicitly select and limit the number of exception lines:

filter {
  ruby {
    code => '
      # Split the full stack trace into individual lines
      stack_lines = event.get("message").split("\n")
      
      # Filter lines that are actual exception entries (tweak the regex here if your exceptions use different patterns)
      exception_entries = stack_lines.select { |line| line.match?(/Exception|Caused by:/) }
      
      # Grab the first 4-5 lines (adjust the number inside `first()` to match your needs)
      extracted_exceptions = exception_entries.first(4).join("\n")
      
      # Store the extracted lines in a new field (you can name this whatever makes sense for your team)
      event.set("extracted_nested_exceptions", extracted_exceptions)
    '
  }
}

If you do want to use pure regex (for learning purposes), here's a grok pattern that matches up to 4 nested exception lines (works best after merging the stack with multiline):

filter {
  grok {
    match => { "message" => "(?<extracted_nested_exceptions>(?:^.*Exception.*$\n?){1,2}(?:^.*Caused by:.*$\n?){0,2})" }
    # This matches 1-2 top-level exceptions + 0-2 nested "Caused by" lines (total 4)
    multiline => true
  }
}

Finish your Logstash config with an output to Elasticsearch:

output {
  elasticsearch {
    hosts => ["http://your_elasticsearch_host:9200"]
    index => "app-exceptions-%{+YYYY.MM.dd}"
  }
}

Once the data is in Elasticsearch, head to Kibana:

• Create an index pattern for your app-exceptions-* index
• Use a Table or Text visualization to display the extracted_nested_exceptions field
• You can also add filters to focus on specific exception types if needed

Pro Tips:

• Test your Logstash config first with bin/logstash -f your_config.conf --config.test_and_exit to catch syntax errors
• If your exceptions use different keywords (e.g., Traceback for Python, Error for Node.js), adjust the regex in the Ruby filter or multiline pattern to match
• Use Kibana's Discover tab to preview the extracted_nested_exceptions field before building visualizations

内容的提问来源于stack exchange，提问作者KapilArora