You could also do this
rex field=exception "(?<shortmessage>[^\r\n])"
which I use with this other bit to get a nice look at "caused by" too:
| rex field=exception "(?<shortmessage>[^\r\n])" | eval shorter_msg=substr(shortmessage,1,180) | rex field=exception "Caused by: (?<caused_by>[^\r\n])" | stats count by level,shortmessage,caused_by | sort count desc
... View more