title: Regex to handle all Multiline exception in rubular fluentd
body: <p>I designed the regex to match the all multiline exception or warning message field for fluentd parser in rubular format as below</p>
  <pre><code>(SLF4J:\s.*|[a-zA-z_]*\..*\.*\s.*\s.*|Caused\sby:\s|\s+at\s.*|\s+\.\.\. (\d)+ more)
  </code></pre>
  <blockquote>
  <p>It matches unnecessary fields.</p>
  </blockquote>
  <p>I want to match all start of exception or warning multiline.
  <em><strong>In short: The most recent multiline will be read from the beginning of the file unitl it gets a next line as JSON.JSON always starts with {&quot; togather. when we see lines begings with {&quot; we will stop reading multiline</strong></em></p>
  <blockquote>
  <p>one regex for both the cases or 2 regex for both the cases is fine</p>
  </blockquote>
  <p><strong>Demo link</strong></p>
  <p><strong>regex is available at: <a href="https://rubular.com/r/O26Wm6mc7z51re" rel="nofollow noreferrer">https://rubular.com/r/O26Wm6mc7z51re</a></strong></p>
  <p><strong>regex is available at: <a href="https://rubular.com/r/v6Q7iwZqmNDAAx" rel="nofollow noreferrer">https://rubular.com/r/v6Q7iwZqmNDAAx</a></strong></p>
  <p><strong>Test Strings is :</strong></p>
  <pre><code>java.lang.InterruptedException: Timeout while waiting for epoch from quorum
          at org.apache.zookeeper.server.quorum.Leader.getEpochToPropose(Leader.java:1227)
          at org.apache.zookeeper.server.quorum.Leader.lead(Leader.java:482)
          at org.apache.zookeeper.server.quorum.QuorumPeer.run(QuorumPeer.java:1284)
          ... 19 more
  {&quot;log_timestamp&quot;: &quot;2021-02-18T11:33:23.114+0000&quot;, &quot;log_level&quot;: &quot;WARN&quot;, &quot;process_id&quot;: &quot;zookeeper#2&quot;, &quot;process_name&quot;: &quot;zookeeper&quot;, &quot;thread_id&quot;: 1, &quot;thread_name&quot;: &quot;QuorumPeer[myid=2](plain=/0.0.0.0:2181)(secure=disabled)&quot;, &quot;action_name&quot;: &quot;org.apache.zookeeper.server.quorum.QuorumPeer&quot;, &quot;log_message&quot;: &quot;PeerState set to LOOKING&quot;}
  {&quot;log_timestamp&quot;: &quot;2021-02-18T11:33:23.115+0000&quot;, &quot;log_level&quot;: &quot;WARN&quot;, &quot;process_id&quot;: &quot;zookeeper#2&quot;, &quot;process_name&quot;: &quot;zookeeper&quot;, &quot;thread_id&quot;: 1, &quot;thread_name&quot;: &quot;WorkerSender[myid=2]&quot;, &quot;action_name&quot;: &quot;org.apache.zookeeper.server.quorum.QuorumPeer&quot;, &quot;log_message&quot;: &quot;Failed to resolve address: zk-2.zk-headless.intam.svc.cluster.local&quot;}
  java.net.UnknownHostException: zk-2.zk-headless.intam.svc.cluster.local
          at java.net.InetAddress.getAllByName0(InetAddress.java:1281)
          at java.net.InetAddress.getAllByName(InetAddress.java:1193)
          at java.net.InetAddress.getAllByName(InetAddress.java:1127)
          at java.net.InetAddress.getByName(InetAddress.java:1077)
          at org.apache.zookeeper.server.quorum.QuorumPeer$QuorumServer.recreateSocketAddresses(QuorumPeer.java:194)
          at org.apache.zookeeper.server.quorum.QuorumPeer.recreateSocketAddresses(QuorumPeer.java:764)
          at org.apache.zookeeper.server.quorum.QuorumCnxManager.connectOne(QuorumCnxManager.java:699)
          at org.apache.zookeeper.server.quorum.QuorumCnxManager.toSend(QuorumCnxManager.java:618)
          at org.apache.zookeeper.server.quorum.FastLeaderElection$Messenger$WorkerSender.process(FastLeaderElection.java:477)
          at org.apache.zookeeper.server.quorum.FastLeaderElection$Messenger$WorkerSender.run(FastLeaderElection.java:456)
          at java.lang.Thread.run(Thread.java:748)
  {&quot;log_timestamp&quot;: &quot;2021-02-18T11:33:23.115+0000&quot;, &quot;log_level&quot;: &quot;WARN&quot;, &quot;process_id&quot;: &quot;zookeeper#2&quot;, &quot;process_name&quot;: &quot;zookeeper&quot;, &quot;thread_id&quot;: 1, &quot;thread_name&quot;: &quot;WorkerSender[myid=2]&quot;, &quot;action_name&quot;: &quot;org.apache.zookeeper.server.quorum.QuorumPeer&quot;, &quot;log_message&quot;: &quot;Failed to resolve address: zk-2.zk-headless.sxc.svc.cluster.local&quot;}
  </code></pre>
  <p><strong>Expected Match :</strong>
  <em>For demo1: <a href="https://rubular.com/r/O26Wm6mc7z51re" rel="nofollow noreferrer">https://rubular.com/r/O26Wm6mc7z51re</a></em></p>
  <pre><code>java.lang.InterruptedException: Timeout while waiting for epoch from quorum
          at org.apache.zookeeper.server.quorum.Leader.getEpochToPropose(Leader.java:1227)
          at org.apache.zookeeper.server.quorum.Leader.lead(Leader.java:482)
          at org.apache.zookeeper.server.quorum.QuorumPeer.run(QuorumPeer.java:1284)
          ... 19 more
  </code></pre>
  <p><em>For demo2 :<a href="https://rubular.com/r/v6Q7iwZqmNDAAx" rel="nofollow noreferrer">https://rubular.com/r/v6Q7iwZqmNDAAx</a></em></p>
  <pre><code>SLF4J: Class path contains multiple SLF4J bindings.
  SLF4J: Found binding in [jar:file:/opt/spark/jars/logback-classic-1.2.3.jar!/org/slf4j/impl/StaticLoggerBinder.class]
  SLF4J: Found binding in [jar:file:/opt/spark/jars/slf4j-log4j12-1.7.30.jar!/org/slf4j/impl/StaticLoggerBinder.class]
  SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
  SLF4J: Actual binding is of type 
  </code></pre>