Need help with grok pattern for logstash config file for Oracle Alert log

Please help with grok pattern for following Oracle Database Alert.log message below to trap ORA- errors and its timestamp using logstash.

Oracle Database alert log has following error log messages:

ORA-12222: Test error
ORA-28365: wallet is not open
ORA-00313: open failed for members of log group 1 of thread 1

How are you ingesting events? Are you using a multiline configuration (either in filebeat or in the codec of a file input)?

I am using multiline configuration in the file input.

OK, if you have an event like

ORA-12222: Test error\n2020-05-11T19:29:15.734411+00:00\n:SS', 'NLS_CALENDAR=GREGORIAN'))

I would start with something like

grok { match => { "message" => "ORA-%{INT:errorCode}: (?<errorMessage>[^\n]+)\n(?<date>[^\n]+)(\n)?" } }
1 Like

Thanks Badger!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.