I am trying to capture a line in a logfile using the onigurama regex library (in Logstash) using a negative look-behind but it still seems to match the line that it shouldn't. I am trying to match only the top level exception and not the one starting with Caused By:
Somebody helped me write this
Tested on Rubular http://rubular.com/r/N3AzySNHiS
Tested Regex
^(?<!Caused by: ).*?Exception
(?<!^Caused by: ).*?Exception
Message:
2016-11-15 05:19:28,801 ERROR [App-Initialisation-Thread] appengine.java:520 Failed to initialize external authenticator myapp Support Access || appuser@vm23-13:/mnt/data/install/assembly app-1.4.12@cad85b224cce11eb5defa126030f21fa867b0dad
java.lang.IllegalArgumentException: Could not check if provided root is a directory
at com.myapp.jsp.KewServeInitContextListener$1.run(QServerInitContextListener.java:104)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.nio.file.NoSuchFileException: fh-ldap-config/
at com.upplication.s3fs.util.S3Utils.getS3ObjectSummary(S3Utils.java:55)
at com.upplication.s3fs.util.S3Utils.getS3FileAttributes(S3Utils.java:64)
Logstash result
"exception" => "Caused by: java.nio.file.NoSuchFileException"
It seems there are some additional options set in your Logstach environment. From my tests, I suspect the "verbose" or "ignore whitespace" option is enabled. Also, to exclude any other issues with . (that may be redefined to match line break symbols), you may use an unambiguous [^\r\n] (any char not \r and \n):
^(?!Caused\ by:)(?<exception>[^\r\n]*?Exception)
^^ ^^^^^^^
The escaped space will always match a single regular space.