<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to format exceptions with log4j to stdout in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-format-exceptions-with-log4j-to-stdout/m-p/456038#M95265</link>
    <description>&lt;P&gt;did you check how the output logs come in notepad++ (or a quality text editor)?&lt;BR /&gt;
My suggestion is to use &lt;CODE&gt;%d{ISO8601} %-5p %c %x - %m%n&lt;/CODE&gt;&lt;/P&gt;</description>
    <pubDate>Wed, 15 May 2019 21:30:48 GMT</pubDate>
    <dc:creator>koshyk</dc:creator>
    <dc:date>2019-05-15T21:30:48Z</dc:date>
    <item>
      <title>How to format exceptions with log4j to stdout</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-format-exceptions-with-log4j-to-stdout/m-p/456037#M95264</link>
      <description>&lt;P&gt;When we had Splunk processing log files, the exceptions looked fine. But now that we are processing just the STDOUT from Docker, the exception stack traces were appearing as separate log messages.  I fixed that in a way, buy removing the line breaks in the message itself with a pattern in log4j. Now it want it appear as separate lines when I view the exception. Is there some character or string that I can substitute so each method in the stack trace appears as a separate line, but not a separate message? &lt;/P&gt;

&lt;P&gt;Here is my current log4j pattern: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;Pattern&amp;gt;%d{ISO8601} %-5p %C{1} - [%x]  %m %throwable{separator(\n)}%n&amp;lt;/Pattern&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In Spunk it appears with a literal "\n" instead of a line break.&lt;/P&gt;

&lt;P&gt;What is the correct Pattern I should use?&lt;/P&gt;</description>
      <pubDate>Wed, 15 May 2019 18:35:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-format-exceptions-with-log4j-to-stdout/m-p/456037#M95264</guid>
      <dc:creator>pwolfpwolf</dc:creator>
      <dc:date>2019-05-15T18:35:02Z</dc:date>
    </item>
    <item>
      <title>Re: How to format exceptions with log4j to stdout</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-format-exceptions-with-log4j-to-stdout/m-p/456038#M95265</link>
      <description>&lt;P&gt;did you check how the output logs come in notepad++ (or a quality text editor)?&lt;BR /&gt;
My suggestion is to use &lt;CODE&gt;%d{ISO8601} %-5p %c %x - %m%n&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 15 May 2019 21:30:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-format-exceptions-with-log4j-to-stdout/m-p/456038#M95265</guid>
      <dc:creator>koshyk</dc:creator>
      <dc:date>2019-05-15T21:30:48Z</dc:date>
    </item>
    <item>
      <title>Re: How to format exceptions with log4j to stdout</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-format-exceptions-with-log4j-to-stdout/m-p/456039#M95266</link>
      <description>&lt;P&gt;@koshyk , without the "throwable{separator}" , log4j outputs the exception as multiple lines with each line in the stack trace being treated as a separate log message, which is not what we want. We are processing the STDOUT of our container, not a log file.&lt;/P&gt;</description>
      <pubDate>Tue, 21 May 2019 19:45:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-format-exceptions-with-log4j-to-stdout/m-p/456039#M95266</guid>
      <dc:creator>pwolfpwolf</dc:creator>
      <dc:date>2019-05-21T19:45:35Z</dc:date>
    </item>
  </channel>
</rss>

