Hi all,
I have a problem with my consumer pattern for response code from ibm websphere, below is explained:
that is my logstash Config:
if [fields][log_type] == "p8_server_error" {
grok {
match => [ "message","%{TIMESTAMP_ISO8601:logtime} %{LOGLEVEL:log-level} \[%{DATA:Orb}\] \- %{DATA} %{DATA} %{DATA:p8-logger-methode} %{GREEDYDATA:Msg}" ]
#overwrite => [ "message" ]
}
mutate { replace => [ "type", "p8_server_error_log" ] }
}
> if [fields][log_type] == "SystemOut-CCE-JVM" {
> grok {
> #patterns_dir => "./patterns"
> match => { "message" =>
["%{DATESTAMP:logtime} %{DATA} %{DATA:thread} %{DATA:java-class} [ ]* %{DATA:sev} %{DATA} \[%{DATA}\] %{LOGLEVEL:log-level} %{GREEDYDATA:Msg}",
>"%{DATESTAMP:logtime} %{DATA} %{DATA:thread} %{DATA:java-class} %{DATA:sev} %{DATA:java-package} %{DATA:cce-java-method} %{GREEDYDATA:Msg}" ]}
> #overwrite => [ "message" ]
> }
> mutate { replace => [ "type", "SystemOut-CCE-JVM_log" ] }
> }
> #response code :
> grok {
> match => ["message", "(?<response_code>[A-Z0-9]{9,10})[:,\s\s]"]
> tag_on_failure => [ ] }
that is where do my response code extract from, logfile:
for the first logfile i get the write Respons code (FNRCE0010E) what am looking for , but look at the Second and Third log will get out a stupid number or a wrong code like this (193630554 ) &(9P4HQ3DRAG) from any chain:
1- log with response code wich is correct:
> 2018-07-30 10:27:42,261 ERROR [ORB.thread.pool : 2] - method name: preExecuteChange principal name: g6603 Global Transaction: true User Transaction: false Exception Info: The value given for a property or list element lies outside the permitted range or value set, or exceeds the maximum length allowed. Loop in folder hierarchy; id = {B04CEA64-0000-CE1D-92DF-75874619583D}. > com.filenet.api.exception.EngineRuntimeException: FNRCE0010E: E_BAD_VALUE: The value given for a property or list element lies outside the permitted range or value set, or exceeds the maximum length allowed. Loop in folder hierarchy; id = {B04CEA64-0000-CE1D-92DF-75874619583D}. failedBatchItem=0 > at com.filenet.engine.persist.FolderPersister.preExecuteChange(FolderPersister.java:121) > at com.filenet.engine.persist.IndependentPersister.executeChangeWork(IndependentPersister.java:499)
2- log with number ResponsCode wrong:
`[7/30/18 4:02:57:331 CEST] 0000011a SystemOut O 193630554 [CSEIndexProcessor$BatchExecutor_null_Worker background task processing645] WARN filenet_error.cbr.com.filenet.engine.cbr.spi.CSEInputStreamImpl - No text was produced from the extraction process for /opt/filenet/collections_temp/sl008848/cpe1member01/OS{B0E9EAD3-6229-407F-AD9E-443B23620D16}/FN16/FN12/FN10/FN{F0E8E864-0000-C412-AE8E-9A02124C665E}{D2D945EB-B2AB-472C-85EE-885C2DBAE650}-0.pdf object:{F0E8E864-0000-C412-AE8E-9A02124C665E} class:OtherDocuments Reason: NO_TEXT_EXTRACTED
3- log with wrong ResponsCode also wrong:
> 9/30/18 7:07:22:878 000000f0 SystemOut O [text..& zeichnen...] ERROR filenet_error.fixed_content_provider.com.filenet.engine.content.fcprovider.centera.CenteraAdaptor - Failed to delete Centera clip id 3F2Q8MJAT4RGFe4P8GQ5AO2F1IPG41CHNC4KG3072J99P4HQ3DRAG (Centera error code: -10005) > com.filepool.fplibrary.FPLibraryException: com.emc.vipr.cashead.api.InternalObjectException: Unable to set object metadata for: 3F2Q8MJAT4RGFe4P8GQ5AO2F1IPG41CHNC4KG3072J99P4HQ3DRAG > at com.emc.vipr.cashead.impl.vipr.ExceptionTranslator.translateError(ExceptionTranslator.java:40) > at com.emc.vipr.cashead.impl.vipr.BlobClientObjectDatastore.setObjectMetadata(BlobClientObjectDatastore.java:321) > at com.emc.vipr.cashead.storageserver.access.transaction.delete.UpdateMetadata.performAction(UpdateMetadata.java:32) > at com.emc.vipr.cashead.storageserver.access.transaction.AbstractTransaction.schedule(AbstractTransaction.java:122) > at com.emc.vipr.cashead.storageserver.access.transaction.NullScheduler.registerSchedulable(NullScheduler.java:48)
can someone help i need to know what i am missing on my customer pattern response code.
Thank you guys