First off, I'm new to logstash so I appreciate any help I can get with this problem.
I'm trying to get some information from the Oracle listener log into logstash but I'm not entirely sure how do that. Logstash reads the file just fine, and I can view the info in Kibana with no problems. But, I really just want certain parts of the information.
Below is a sample of the logfile. Lots of information but the only rows I'm really interested in are the ones that have the word 'established' in them.
Then for each of those lines I want a certain number of fields (from the highlighted example below):
DATE -> (12-OCT-2015 10:32:33)
SERVICE_NAME -> (asmdb)
PROGRAM -> (sqlplus@db1)
USER -> (oracle)
HOST -> (db1)
So basically, a grep for 'established' and then regexp the fields I want. I guess grok is the way to go but I cant really figure it out.
Mon Oct 12 10:31:09 2015
WARNING: Subscription for node down event still pending
12-OCT-2015 10:32:09 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=db1)(USER=oracle))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=186647552)) * status * 0
Mon Oct 12 10:32:32 2015
12-OCT-2015 10:32:33 * (CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=asmdb)(CID=(PROGRAM=sqlplus@db1)(HOST=db1)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=38999)) * establish * asmdb * 0
12-OCT-2015 10:32:33 * service_update * asmdb * 0
12-OCT-2015 10:32:36 * service_update * asmdb * 0
Thanks in advance!