title: Parsing java logs for multiline entries using bash
body: <p>I have loads of java logs on a Linux machine and I'm trying to find a grep expression or something else (perl, awk) that gives me the entire log entry on a match somewhere in its body. Logstash looks like it could do the job, but something with onboard tools would be way better.</p>
  
  <p>An example should help best. Here is an exemplary log with 5 different entries:</p>
  
  <pre><code>25 Aug 2016 14:00:46,435 DEBUG [User][IP][rsc] An error occurred 
  java.Exception: Foo1
   at xyz
  25 Aug 2016 14:00:46,436 Foo2 [User][IP][rsc] Some error occured
  25 Aug 2016 14:00:46,436 DEBUG [User][IP][rsc] Somethin occured Foo3
  25 Aug 2016 14:18:18,224 XYZ [User][IP][rsc] Some problems
  More: bla1
  More: bla2
  USER.bla.bla: Blala::123 - 456
  More: Could not open something
   at 567
   at 890
  Caused by: Foo4: Could not open another thing
   at 123
   at 456
   ... 127 more
  Caused by: gaga
   at a1a2a3
   at b3b3b3
   ... 146 more
  25 Aug 2016 14:18:20,118 SSO [User][IP][rsc] Process: error -
  Could not Foo5
  &lt;here is a blank line&gt;
  </code></pre>
  
  <p>When I search for "Foo1", I need:</p>
  
  <pre><code>25 Aug 2016 14:00:46,435 DEBUG [User][IP][rsc] An error occurred 
  java.Exception: Foo1
   at xyz
  </code></pre>
  
  <p>When I search for "Foo2":</p>
  
  <pre><code>25 Aug 2016 14:00:46,436 Foo2 [User][IP][rsc] Some error occured
  </code></pre>
  
  <p>For "Foo3":</p>
  
  <pre><code>25 Aug 2016 14:00:46,436 DEBUG [User][IP][rsc] Somethin occured Foo3
  </code></pre>
  
  <p>For "Foo4":</p>
  
  <pre><code>25 Aug 2016 01:18:18,224 XYZ [User][IP][rsc] Some problems
  More: bla1
  More: bla2
  USER.bla.bla: Blala::123 - 456
  More: Could not open connection
   at 567
   at 890
  Caused by: Foo4: Could not open connection
   at 123
   at 456
   ... 127 more
  Caused by: gaga
   at a1a2a3
   at b3b3b3
   ... 146 more
  </code></pre>
  
  <p>And finally for "Foo5":</p>
  
  <pre><code>25 Aug 2016 01:18:20,118 SSO [User][IP][rsc] Process: error -
  Could not Foo5
  </code></pre>
  
  <p>When I search for "Foo", everything should be returned. 
  Is something like this possible? Maybe even as a one liner?
  I would like to use it in a Webmin Custom Commands module where I supply the expression via variable.</p>
  
  <p>The only basic idea I have at the moment is search for the expression and use the "[" as pattern to identify where a new entry begins.</p>
  
  <p>Thanks in advance for anybody who has an idea!</p>