由于logstash是一行一行匹配数据的，Java堆栈信息一般会占用很多行，如果想放到一起显示，那么需要单独设置

    日志样例

    1. 2020-04-22 14:17:03.518  |||  |ERROR  |3482  |[Thread-7]  |RedirectingEurekaHttpClient.java:91  |c.n.d.s.t.d.RedirectingEurekaHttpClient  : Request execution error. endpoint=DefaultEndpoint{ serviceUrl='http://localhost:8761/eureka/}
    2. com.sun.jersey.api.client.ClientHandlerException: java.net.ConnectException: Connection refused (Connection refused)
    3.         at com.sun.jersey.client.apache4.ApacheHttpClient4Handler.handle(ApacheHttpClient4Handler.java:187)
    4.         at com.sun.jersey.api.client.filter.GZIPContentEncodingFilter.handle(GZIPContentEncodingFilter.java:123)
    5.         at com.netflix.discovery.EurekaIdentityHeaderFilter.handle(EurekaIdentityHeaderFilter.java:27)
    6.         at com.sun.jersey.api.client.Client.handle(Client.java:652)
    7.         at com.sun.jersey.api.client.WebResource.handle(WebResource.java:682)
    8.         at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
    9.         at com.sun.jersey.api.client.WebResource$Builder.delete(WebResource.java:591)
    10.         at com.netflix.discovery.shared.transport.jersey.AbstractJerseyEurekaHttpClient.cancel(AbstractJerseyEurekaHttpClient.java:76)
    11.         at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$2.execute(EurekaHttpClientDecorator.java:74)
    12.         at com.netflix.discovery.shared.transport.decorator.MetricsCollectingEurekaHttpClient.execute(MetricsCollectingEurekaHttpClient.java:73)
    13.         at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.cancel(EurekaHttpClientDecorator.java:71)
    14.         at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$2.execute(EurekaHttpClientDecorator.java:74)
    15.         at com.netflix.discovery.shared.transport.decorator.RedirectingEurekaHttpClient.execute(RedirectingEurekaHttpClient.java:89)
    16.         at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.cancel(EurekaHttpClientDecorator.java:71)
    17.         at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$2.execute(EurekaHttpClientDecorator.java:74)
    18.         at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:120)
    19.         at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.cancel(EurekaHttpClientDecorator.java:71)
    20.         at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$2.execute(EurekaHttpClientDecorator.java:74)

    filebeat.yml文件配置如下：

    1. - type: log
    2.   enabled: true
    3.   paths:
    4.    - /home/situ/logs/*/error.*.log
    5.   multiline:
    6.    pattern: '^\d+'
    7.    negate:  true
    8.    match:   after
    9.   fields:
    10.    appname: beta-microservice-citicpru-error-log

    image.png