Hi,

I have a situation where we log and ship java errors along with their stacktraces to a log analyzer (splunk).

I am trying to figure out a way where I can get "unique error titles" along with their error message (which comes in 2nd line of stacktrace). The problem is error message has various numbers which I want to be skipped in unique title.

Let me give an example(please note that error message in 2nd line is optional):

Error String#1:

ERROR [OptionalTasks:1] 2013-08-25 21:50:49,505 AbstractCassandraDaemon.java (line 132) Exception in thread Thread[OptionalTasks:1,5,main]
java.lang.NullPointerException

Error String#2:

ERROR [OptionalTasks:100] 2013-08-25 21:10:49,505 AbstractCassandraDaemon.java (line XXX) Exception in thread Thread[OptionalTasks:10,50,main]
java.lang.NullPointerException

My unique error title out of above scenarios should be:

ERROR [OptionalTasks:NumberToBeIgnored1] A_DATE AbstractCassandraDaemon.java (line NumberToBeIgnored2) Exception in thread Thread[OptionalTasks:NumberToBeIgnored3,NumberToBeIgnored4,main] java.lang.NullPointerException

* Note the optional newline is converted to a space in unique title
* The format of string is fixed including space, commas, date and brackets

So far I have tried below regex which is far from finished I believe (please ignore the double quotes):

"^ERROR \[(?<title>\w+:\d+)"

Any pointers would be appreciated.

Thanks,
Ashish