How can we get the java exception as one event?

[ddrillic]

We have data that looks like -

2017-08-01 13:32:05,079 INFO  [stdout] (ajp-/0.0.0.0:8009-35) LogData[
2017-08-01 13:32:05,079 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   className=UserValidationAppService
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   methodName=UserValidationAppService.validateUser(..)
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   corrId=fbc6c881-1b0b-43c7-83da-07342bc8934d
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   userId=3f499bb6-6838-4c08-badc-c2e13a313901
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   argsArray=[ "3f499bb6-6838-4c08-badc-c2e13a313901", "user", false ]
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   methodEntryTime=2017-08-01T13:32:04.868-05:00
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   methodExitTime=2017-08-01T13:32:05.077-05:00
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   throwable=
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35) com.xxxxxx.common.exception.ServiceRuntimeException: An error occured while ....
......

2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   at java.util.concurrent.FutureTask.run(FutureTask.java:262)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   ... 1 more
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35) ]

How can we extract the event to be everything the LogData contains between the square brackets with various fields including throwable which can be fairly large?

[mwirth_splunk]

I'm assuming that there are events that truly are only one line mixed with these exception dumps?

I'd recommend looking into "MUST_BREAK_AFTER" and "MUST_NOT_BREAK_AFTER" in props.conf
So you'd end up with something like;

MUST_BREAK_AFTER= \]
MUST_NOT_BREAK_AFTER=\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3}\s.+?LogData\[

The idea here is that Splunk will continue to linebreak each line unless it detects that "LogData[" string, at which point it will stop linebreaking until it encounters the close bracket. Hopefully this will make one event out of many.

[ddrillic]

Perfect @mwirth - I'll try it...