Hi Thank you in advance.
i am very stuggle to deal with this problem.
push the oracle alert.log from the filebeat to logstash and see int ths slack message.
my data source in alert log (Mon Apr 4 15:11:52 KST 2022 한글 테스트입니다. (ORA-3136) ) . filebeat didn't take the korean messages. it's shown as
Mon Apr 04 15:40:06 2022\nErrors in file /log/diag/rdbms/campdb/CAMPDB1/trace/CAMPDB1_ora_35639.trc:\nORA-01013: ?ъ?⑹??媛 ?????????? 痍⑥??瑜???泥????듬????" "
that message text is broken.