Oniguruma pattern - end of the line will not work

Question

I have a field like that named problem:

java.lang.NullPointerException: null\\n09:56:49.712 pl.com.agora.api.client.rest.invocation.FutureCallbacksSupport {HttpClient@2052321524-scheduler} ERROR : Uri invocation failure callback failed.

And I want to exclude from it exception.

(?<exception>java(.*)Exception\z)

So I will have field exception with value: java.lang.NullPointerException

Can not seem to find end of the line which would work. \z or \Z are not working like I want it to. Didn't find the answer here as well: https://github.com/stedolan/jq/wiki/Docs-for-Oniguruma-Regular-Expressions-(RE.txt)

It is used in logstash and grok match:

filter {
  grok {
      match => { "message" => '%{TIME:timestamp} (\[)?(%{DATA:logger})?(\])? \{%{DATA:thread}\} %{LOGLEVEL:level} : (?<problem>(.|\r|\n)*)' }
      remove_field => ["message"]
      }
  grok {
      match => { "problem" => '(?<exception>java(.*)Exception\z)' }
  }

}

Answer 1

The regex (?<exception>java(.*)Exception\z) will search for the following content:

1. The word java
2. Any content, including an empty string (.*)
3. The word Exception
4. The end of the input \z

However, there is no word "Exception" at the end of the input (\z). You have additional content between "Exception" and the end of the input. So you have to match this additional input as well. It might be as simple as:

(?<exception>java(.*)Exception).*\z

This will be split up into:

1. The word java
2. Any content, including an empty string (.*)
3. The word Exception
4. Any content, including an empty string (.*)
5. The end of the input (\z)

Which capture brackets you need depends on what you want to do.