Hi all together,
i need your help because i have to finish a project in my company.
I've got this log:
Recovery Manager: Release 12.1.0.2.0 - Production on Tue Apr 24 18:30:01 2018
Copyright (c) 1982, 2014, Oracle and/or its affiliates. All rights reserved.xxx #privateinformationofthecompany
channel c1: backup set complete, elapsed time: 00:00:01
Finished backup at 24-APR-18released channel: c1
Recovery Manager complete.
I want to extract these strings which are written cursive in the log above:
-
Tue Apr 24 18:30:01 2018
as date -
00:00:01
as duration -
Recovery Manager complete
as Status
This is my logstash.conf:
input {
beats{
port => 5044
}
}
if [tag] == "CLD1"{
grok {
match => {"message" => ["\ARecovery Manager: Release 12.1.0.2.0 - Production on %{HTTPDERROR_DATE:timestamp} (?[\r\n]+)"] }
}
date {
match => [ "timestamp", "E MMM dd HH:mm:ss yyyy"]
}
#mutate {
# remove_field => ["day, month, monthday, time, year"]
#}
}
}output {
if [@metadata][beat] == "filebeat" {
elasticsearch {
hosts => ["localhost:9200"]
user => elastic
password => elastic
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
}
No matter how i change the grok, there are no new fields in my elasticsearch Events.
Please can somebody help me!
Thank you very much!!