Send data in seperate lines from beats

Hi ,

We are configuring Siebel app server monitoring and we are running a batch file in execbeat . our output looks like below .


Siebel Enterprise Applications Siebel Server Manager, Version 16.19.0.0 [23057] LANG_INDEPENDENT
Copyright (c) 2008,2016, Oracle. All rights reserved.

The Programs (which include both the software and documentation) contain
proprietary information; they are provided under a license agreement containing
restrictions on use and disclosure and are also protected by copyright, patent,
and other intellectual and industrial property laws. Reverse engineering,
disassembly, or decompilation of the Programs, except to the extent required to
obtain interoperability with other independently created software or as specified
by law, is prohibited.

Oracle, JD Edwards, PeopleSoft, and Siebel are registered trademarks of
Oracle Corporation and/or its affiliates. Other names may be trademarks
of their respective owners.

If you have received this software in error, please notify Oracle Corporation
immediately at 1.800.ORACLE1.

Type "help" for list of commands, "help " for detailed help

Connected to 13 server(s) out of a total of 13 server(s) in the enterprise

srvrmgr> list comp show SV_NAME,CC_ALIAS,CP_DISP_RUN_STATE,CP_STARTMODE,CP_NUM_RUN_TASKS,CP_MAX_TASKS,CC_NAME order by CP_DISP_RUN_STATE

SV_NAME CC_ALIAS CP_DISP_RUN_STATE CP_STARTMODE CP_NUM_RUN_TASKS CP_MAX_TASKS CC_NAME


D1220001027A FSMSrvr Online Auto 0 20 File System Manager
D1220001027A ServerMgr Running Auto 4 20 Server Manager
D1220001027A SRBroker Running Auto 29 100 Server Request Broker
D1220001027A SRProc Running Auto 2 20 Server Request Processor
D1220001027A SvrTaskPersist Running Auto 1 1 Server Task Persistance
D1220001027A SCBroker Running Auto 2 2 Siebel Connection Broker
D1220001027A SvrTblCleanup Shutdown Manual 0 1 Server Tables Cleanup
D1220001030A CACWfProcMgrPE Online Auto 0 20 CAC Workflow Process Manager Process Engine
D1220001030A FSMSrvr Online Auto 0 20 File System Manager
D1220001030A SFMWfProcMgrPE Online Auto 0 20 SFM Workflow Process Manager Process Engine
D1220001030A ServerMgr Running Auto 4 20 Server Manager


I am sending this whole data to Logstash to parse from Execbeat and trying to filter same using Grok ,

I want only the info data which sample looks like below , and no other info

D1220001030A ServerMgr Running Auto 4 20 Server Manager

It should be stored in separate each line , but the whole file to logstash coming as a single line .

My Grok filter which is matching above line is :

filter {
grok {
match => {"message" => "%{WORD:ServerName}%{SPACE}%{WORD:Comp_Alias}%{SPACE}%{WORD:CompStatus}%{SPACE}%{WORD:CompStartMode}%{SPACE}%{WORD:RunningTasks}%{SPACE}%{WORD:MaxTasks}%{GREEDYDATA:CompName}"}
}
}

So , If i see in Kibana , i see whole thing , where as i want beats to send as seperate lines to Logstash so that Logstash will consider each line . Any way can we send the output of my command as seperate lines to logstash ? .Please help .

Thanks in Advance
Saravana S

Any reply here please ?

Any suggestions please ?

Hey @Saravana37,

I don't know about execbeat, but Filebeat sends one line per event by default, would it be possible to use it in your use case?

Thanks @jsoriano for the reply . My requirement is to execute a command in the commandline and send the output to Logstash for parshing . I believe filebeat is for shipping the logs ?

Yes, filebeat collects logs from files and other inputs. You would still need something to execute the command and write the output to a file.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.