# Need help with grok pattern for logstash config file for Oracle Alert log

**URL:** <https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313>\
**Category:** Logstash\
**Created:** [May 12, 2020, 8:02pm UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313 "2020-05-12T20:02:07Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gaurav\_Batta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaurav_batta/32/68191_2.png) [@Gaurav\_Batta](https://discuss.elastic.co/u/Gaurav_Batta)\
**Post date:** [May 12, 2020, 8:02pm UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313/1 "2020-05-12T20:02:07Z")

</div>

Please help with grok pattern for following Oracle Database Alert.log message below to trap ORA- errors and its timestamp using logstash.

Oracle Database alert log has following error log messages:

`````auto
ORA-12222: Test error
2020-05-11T19:29:15.734411+00:00
:SS', 'NLS_CALENDAR=GREGORIAN'))
ORA-28365: wallet is not open
2020-05-12T14:57:06.103705+00:00
ORA-00313: open failed for members of log group 1 of thread 1
2020-04-10T19:34:36.315579+00:00````
`````

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 12, 2020, 11:23pm UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313/2 "2020-05-12T23:23:20Z")

</div>

How are you ingesting events? Are you using a multiline configuration (either in filebeat or in the codec of a file input)?

---

<div class="post-metadata">

**Author:** ![Gaurav\_Batta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaurav_batta/32/68191_2.png) [@Gaurav\_Batta](https://discuss.elastic.co/u/Gaurav_Batta)\
**Post date:** [May 13, 2020, 2:42am UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313/3 "2020-05-13T02:42:01Z")

</div>

Hi,  
I am using multiline configuration in the file input.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 13, 2020, 3:37pm UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313/4 "2020-05-13T15:37:25Z")

</div>

OK, if you have an event like

```
ORA-12222: Test error\n2020-05-11T19:29:15.734411+00:00\n:SS', 'NLS_CALENDAR=GREGORIAN'))

```

I would start with something like

```
grok { match => { "message" => "ORA-%{INT:errorCode}: (?<errorMessage>[^\n]+)\n(?<date>[^\n]+)(\n)?" } }
```

---

<div class="post-metadata">

**Author:** ![Gaurav\_Batta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaurav_batta/32/68191_2.png) [@Gaurav\_Batta](https://discuss.elastic.co/u/Gaurav_Batta)\
**Post date:** [May 13, 2020, 6:22pm UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313/5 "2020-05-13T18:22:41Z")

</div>

Thanks Badger!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2020, 6:22pm UTC](https://discuss.elastic.co/t/need-help-with-grok-pattern-for-logstash-config-file-for-oracle-alert-log/232313/6 "2020-06-10T18:22:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.