I have a problem working with grok pattern My log is similar to the example below
2023-11-19 13:53:56.024 my-service [http-nio-9004-exec-3] ERROR ErrorTransformer 1700389436-718213 - Error: org.springframework.messaging.MessageHandlingException: HTTP request execution failed for URI [http://localhost:8000/*******/*******/******/****-*****/resources/**********/pin/nopin?hash=2bbad8abcf3b752a4ea90352361d26c2602
In the attached sample log, after the word Error: the continuation of the log is not placed on a new line, but in the real sample, the continuation of the log is on a new line.
EX:
Error:
org.springframework
And my grok pattern is similar to the example below
%{TIMESTAMP_ISO8601:LogDateTime}\s+%{USERNAME:ServiceName}\s+\[%{DATA:Thread}\]\s+%{LOGLEVEL:LogLevel}\s+%{DATA:LoggerName}\s+%{DATA:ReferenceId}(?:\s+-)?\s+%{DATA:LogType}(?<message>(?:(.|\r|\rn|)*))
In the sample log, a special situation occurred and after the word Error: the continuation of the log was recorded in a new line, and I failed to find a special pattern for this situation.
The first part of the log has detected all the patterns without any problems, but the second part after the word Error: the continuation of the log is recorded on a new line and the pattern did not work correctly.
I tried different modes at the end of the pattern, but the desired output was not achieved I got help from https://grokdebugger.com/ %{GREEDYDATA:message} not working