we need to filter the select query but logstash reads just this line :
15:49:05,479 DEBUG [org.hibernate.stat.internal.ConcurrentStatisticsImpl] (default task-43) HHH000117: HQL: select T from translator_MenuTranslator T where (T.codeMessage = ?1 and (T.language = ?2 and (T.label = ?3 and T.label = ?4))), time: 2ms, rows: 0
and i need to filter for exemple this two lines:
15:49:05,479 DEBUG [org.hibernate.stat.internal.ConcurrentStatisticsImpl] (default task-43) HHH000117: HQL: select T from translator_MenuTranslator T where (T.codeMessage = ?1 and (T.language = ?2 and (T.label = ?3 and T.label = ?4))), time: 2ms, rows: 0
15:49:01,193 DEBUG [org.hibernate.stat.internal.ConcurrentStatisticsImpl] (default task-39) HHH000117: HQL: select T from translator_UseCaseTitle T where (T.language = ?1 and (T.className = ?2 and T.useCaseName = ?3)), time: 5ms, rows: 0
here is my filter:
filter{
grok { match => [ "message", "%{TIME:timestamp}\s%{LOGLEVEL:level} [%{JAVACLASS:class}]\s(%{GREEDYDATA:thread}) HHH000117: HQL: %{GREEDYDATA:[@metadata][text]}" ]}
if [type] == "logs" {
dissect { mapping => [ "message", '%{[@metadata][ts]} [%{}] [%{}] %{[@metadata][text]}' ]}}
mutate { add_field => { "[@metadata][static]" => "1" } }
if [@metadata][text] =~ /^select/ {
grok { match => [ "[@metadata][text]", "select T from %{GREEDYDATA:tableName}T where (T.codeMessage = ?%{NOTSPACE}1 and (T.language = ?%{NOTSPACE}2 and (T.label = ?%{NOTSPACE}3 and T.label = ?%{NOTSPACE}4))), time:\s%{GREEDYDATA:duration}\ms,\s%{GREEDYDATA:rows}" ]}
aggregate {
task_id => "%{[@metadata][static]}"
code => "map['id'] = event.get(time);"
}
}
if "_grokparsefailure" in [tags] {
drop{}
}
}
where is the problem !!!!