# Oracle DB alert log config error on Logstash 6.4

**URL:** <https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995>\
**Category:** Logstash\
**Created:** [October 11, 2018, 6:54am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995 "2018-10-11T06:54:57Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![sandeep2](https://avatars.discourse-cdn.com/v4/letter/s/f0a364/32.png) [@sandeep2](https://discuss.elastic.co/u/sandeep2)\
**Post date:** [October 11, 2018, 6:54am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/1 "2018-10-11T06:54:57Z")

</div>

Sending Logstash logs to D:/Hexa\_Software/ELK/logstash-6.4.2/logs which is now configured via log4j2.properties  
[2018-10-11T11:51:02,241][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2018-10-11T11:51:02,780][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.4.2"}  
[2018-10-11T11:51:03,253][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, { at line 10, column 10 (byte 152) after filter {\n \n# Join lines based on the time\nmultiline", :backtrace=\>["D:/Hexa\_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "D:/Hexa_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "D:/Hexa\_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "D:/Hexa\_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "D:/Hexa\_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "D:/Hexa_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "D:/Hexa\_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "D:/Hexa_Software/ELK/logstash-6.4.2/logstash-core/lib/logstash/agent.rb:309:in`block in converge\_state'"]}  
[2018-10-11T11:51:03,543][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

====================== Config File================  
input {  
file {  
path =\> "D:/Hexa\_Software/ELK/logstash-6.4.2/bin/Test/alert\_spf.log"  
}  
}

filter {

# Join lines based on the time

multiline {  
pattern =\> "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"  
negate =\> true  
what =\> "previous"  
}

# Create new field: oradb\_status: starting,running,shutdown

if [message] =~ /Starting ORACLE instance/ {  
mutate {  
add\_field =\> ["oradb\_status", "starting"]  
}  
} else if [message] =~ /Instance shutdown complete/ {  
mutate {  
add\_field =\> ["oradb\_status", "shutdown"]  
}  
} else {  
mutate {  
add\_field =\> ["oradb\_status", "running"]  
}  
}

# Search for ORA- and create field if match

if [message] =~ /ORA-/ {  
grok {  
match =\> ["message","(?ORA-[0-9]\*)" ]  
}  
}

# Extract the date and the rest from the message

grok {  
match =\> ["message","%{DAY:day} %{MONTH:month} %{MONTHDAY:monthday} %{TIME:time} %{YEAR:year}(?\<log\_message\>.\*$)"]  
}

mutate {  
add\_field =\> {  
"timestamp" =\> "%{year} %{month} %{monthday} %{time}"  
}  
}

# replace the timestamp by the one coming from the alert.log

date {  
locale =\> "en"  
match =\> ["timestamp" , "yyyy MMM dd HH:mm:ss"]  
}

# replace the message (remove the date)

mutate { replace =\> ["message", "%{log\_message}"] }

mutate {  
remove\_field =\> ["time" ,"month","monthday","year","timestamp","day","log\_message"]  
}

}

output {  
elasticsearch {  
hosts =\> ["[http://XXXXX:9200](http://XXXXX:9200)"]  
index =\> "oracle-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [October 11, 2018, 7:20am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/2 "2018-10-11T07:20:40Z")

</div>

> [@sandeep2](#):
>
> Expected one of #, { at line 10, column 10 (byte 152) after filter {\n \n# Join lines based on the time\nmultiline"

Logstash combines all the files in your config directory into a single file. When there's an error, you're getting line and position information from the merged config file.

Run the following command to combine all conf file into a single file and then check line number 10.

```auto
cat /etc/logstash/conf.d/* > /tmp/single.conf

```

---

<div class="post-metadata">

**Author:** ![sandeep2](https://avatars.discourse-cdn.com/v4/letter/s/f0a364/32.png) [@sandeep2](https://discuss.elastic.co/u/sandeep2)\
**Post date:** [October 11, 2018, 10:22am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/3 "2018-10-11T10:22:22Z")

</div>

I am using windows, please help me out on this , I am every new to this tools.

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [October 12, 2018, 4:57am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/4 "2018-10-12T04:57:43Z")

</div>

Use `type` command to combine all the conf files into a single file.

---

<div class="post-metadata">

**Author:** ![sandeep2](https://avatars.discourse-cdn.com/v4/letter/s/f0a364/32.png) [@sandeep2](https://discuss.elastic.co/u/sandeep2)\
**Post date:** [October 12, 2018, 8:14am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/5 "2018-10-12T08:14:37Z")

</div>

following is my DB alert log format

Thu Aug 09 12:14:47 2018  
Adjusting the default value of parameter parallel\_max\_servers  
from 320 to 231 due to the value of parameter processes (300)  
Starting ORACLE instance (normal) (OS id: 14860)  
Thu Aug 09 12:14:47 2018  
CLI notifier numLatches:13 maxDescs:519  
LICENSE\_MAX\_SESSION = 0  
LICENSE\_SESSIONS\_WARNING = 0  
Initial number of CPU is 8  
Number of processor cores in the system is 4  
Number of processor sockets in the system is 1  
Shared memory segment for instance monitoring created  
Picked latch-free SCN scheme 3  
Using LOG\_ARCHIVE\_DEST\_1 parameter default value as D:\app\oracle\product\12.1.0\dbhome\_1\RDBMS  
Autotune of undo retention is turned on.  
IMODE=BR  
ILAT =51  
LICENSE\_MAX\_USERS = 0  
SYS auditing is enabled  
NOTE: remote asm mode is local (mode 0x1; from cluster type)  
NOTE: Using default ASM root directory ASM  
Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production  
With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options.  
Windows NT Version V6.2  
CPU : 8 - type 8664, 4 Physical Cores  
Process Affinity : 0x0x0000000000000000  
Memory (Avail/Total): Ph:26393M/32656M, Ph+PgF:28812M/37776M  
Using parameter settings in client-side pfile D:\APP\ORACLE\CFGTOOLLOGS\DBCA\SPF\INITSPFTEMPOMF.ORA on machine IN-PPM2968  
System parameters with non-default values:  
processes = 300  
sga\_target = 1520M  
control\_files = "D:\APP\ORACLE\CFGTOOLLOGS\DBCA\SPF\TEMPCONTROL.CTL"  
db\_block\_size = 8192  
compatible = "12.1.0.2.0"  
undo\_tablespace = "UNDOTBS1"  
remote\_login\_passwordfile= "EXCLUSIVE"  
db\_domain = "[ingrnet.com](http://ingrnet.com)"  
dispatchers = "(PROTOCOL=TCP) (SERVICE=SPFXDB)"  
audit\_file\_dest = "D:\APP\ORACLE\ADMIN\SPF\ADUMP"  
audit\_trail = "DB"  
db\_name = "seeddata"  
db\_unique\_name = "SPF"  
open\_cursors = 300  
star\_transformation\_enabled= "TRUE"  
pga\_aggregate\_target = 504M  
\_diag\_hm\_rc\_enabled = FALSE  
diagnostic\_dest = "D:\APP\ORACLE"  
enable\_pluggable\_database= TRUE  
NOTE: remote asm mode is local (mode 0x1; from cluster type)  
Starting background process PMON  
Thu Aug 09 12:15:08 2018  
PMON started with pid=2, OS id=16248  
Starting background process PSP0  
Starting background process VKTM  
Thu Aug 09 12:15:09 2018  
PSP0 started with pid=3, OS id=9372  
Thu Aug 09 12:15:11 2018  
VKTM started with pid=4, OS id=16124 at elevated (Time Critical) priority  
Thu Aug 09 12:15:11 2018  
VKTM running at (5)millisec precision with DBRM quantum (100)ms  
Starting background process GEN0  
Starting background process MMAN  
Thu Aug 09 12:15:12 2018  
MMAN started with pid=6, OS id=2692  
Starting background process DIAG  
Thu Aug 09 12:15:12 2018  
DIAG started with pid=7, OS id=12888  
Thu Aug 09 12:15:12 2018  
GEN0 started with pid=5, OS id=10644  
Starting background process DBRM  
Thu Aug 09 12:15:13 2018  
DBRM started with pid=8, OS id=15156  
Starting background process VKRM  
Starting background process DIA0  
Thu Aug 09 12:15:13 2018  
DIA0 started with pid=11, OS id=12600  
Thu Aug 09 12:15:13 2018  
VKRM started with pid=10, OS id=9920  
Starting background process DBW0  
Starting background process LGWR  
Thu Aug 09 12:15:14 2018  
LGWR started with pid=12, OS id=6416  
Thu Aug 09 12:15:14 2018  
DBW0 started with pid=9, OS id=10720  
Starting background process CKPT  
Thu Aug 09 12:15:15 2018  
CKPT started with pid=13, OS id=12944  
Starting background process SMON  
Thu Aug 09 12:15:15 2018  
SMON started with pid=15, OS id=2136  
Starting background process RECO

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [October 12, 2018, 8:22am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/6 "2018-10-12T08:22:54Z")

</div>

Hi  
Sandeep, Please check line number 10 of the logstash config file after combining all the config files into a single file using type command.

---

<div class="post-metadata">

**Author:** ![sandeep2](https://avatars.discourse-cdn.com/v4/letter/s/f0a364/32.png) [@sandeep2](https://discuss.elastic.co/u/sandeep2)\
**Post date:** [October 12, 2018, 8:48am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/7 "2018-10-12T08:48:46Z")

</div>

multiline { -----Line number 10 and following is the rest of code.

```
pattern => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"
negate => true
what => "previous"

```

}

Note: I am using only one config file and i have posted above, if you want i can re-post it

---

<div class="post-metadata">

**Author:** ![sandeep2](https://avatars.discourse-cdn.com/v4/letter/s/f0a364/32.png) [@sandeep2](https://discuss.elastic.co/u/sandeep2)\
**Post date:** [October 15, 2018, 9:44am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/8 "2018-10-15T09:44:51Z")

</div>

Any one Help me on this issue

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2018, 9:44am UTC](https://discuss.elastic.co/t/oracle-db-alert-log-config-error-on-logstash-6-4/151995/9 "2018-11-12T09:44:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.