# Siebel log monitoring through ELK stack **URL:** \ **Category:** Logstash\ **Created:** [May 10, 2016, 6:02am UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612 "2016-05-10T06:02:11Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\ **Post date:** [May 10, 2016, 6:02am UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/1 "2016-05-10T06:02:11Z")
Hi All, Using ELK stack, we are monitoring all our Weblogic & SOA logs. Now we are planning to monitor SIEBEL logs using ELK stack. For every 5 mins, logs with format " /tmp/htimObjMgr\_enu\_0299\_\*.log " are generating with below content. 2021 2016-05-10 01:18:16 0000-00-00 00:00:00 -0400 00000000 001 003f 0001 09 htimObjMgr\_enu 2121270867 39010 -1136657552 /tmp/htimObjMgr\_enu\_2023\_2121270867.log 8.1.1.11 [23030] ENU ObjMgrLog Error 1 0020552a5713208d:0 2016-05-10 01:18:16 (cscfg.cpp (165)) SBL-CSR-00418: Communication: User is not associated with any communication configuration in the database. ObjMgrLog Error 1 0020552a5713208d:0 2016-05-10 01:19:14 (sweview.cpp (1884)) SBL-UIF-00401: View: CUT Home Page View (CME) does not contain applet: . Prepared .conf file with below code. Data is saving in Elasticserach. But not able to see that in KIBANA. Please assist me and provide solution to monitor SIEBEL logs. input { stdin { type =\> "stdin-type" } file { type =\> "htim\_log" path =\> ["/tmp/htim\*.log"] } } filter { multiline { pattern =\> "\n^[A-Z]" what =\> "previous" } grok { type =\> "htim\_log" pattern =\> ["\A%{WORD:EventType}%{SPACE}%{WORD:EventSubType}%{SPACE}%{INT:Severity}%{SPACE}%{WORD:SARMID}%{NOTSPACE}%{SPACE}%{PROG:EventDate}%{SPACE}%{TIME:EventTime}%{SPACE}%{GREEDYDATA:LogMessage}"] add\_field =\> ["Project", "Siebel"] add\_field =\> ["Environment", "prod14"] add\_field =\> ["Lifecycle Status", "Production"] add\_field =\> ["Location", "NC"] add\_field =\> ["Log Name", "prod14 htim Log"] add\_field =\> ["Server", "usncx295"] } mutate { uppercase =\> ["EventSubType"] uppercase =\> ["LogMessage"] } } output { elasticsearch { host =\> server135 protocol =\> "http" } } Thanks In advance. Regards, Bharath ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 10, 2016, 7:14am UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/2 "2016-05-10T07:14:07Z")
> [@Bharath\_Paruchuri](#): > > Data is saving in Elasticserach How do you know this? Are you sure the data is there? ---
**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\ **Post date:** [May 10, 2016, 3:02pm UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/3 "2016-05-10T15:02:23Z")
Yes. Because i can see the Fields which i mention in pattern are showing in KIBANA fields list. Also running with Verbose option is showing fields peoperly. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 10, 2016, 8:53pm UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/4 "2016-05-10T20:53:14Z")
Maybe your time frame is wrong, have you tried changing that? ---
**Author:** ![Bharath\_Paruchuri](https://avatars.discourse-cdn.com/v4/letter/b/43a26b/32.png) [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\ **Post date:** [May 12, 2016, 2:30pm UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/5 "2016-05-12T14:30:20Z")
I'm not clear. Could you please elaborate .. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 12, 2016, 9:36pm UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/6 "2016-05-12T21:36:11Z")
In KB you define a time range for the data you are looking at. Perhaps you need to adjust that? ---
**Author:** ![vinodr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinodr/32/28759_2.png) [@vinodr](https://discuss.elastic.co/u/vinodr)\ **Post date:** [May 31, 2016, 4:27pm UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/7 "2016-05-31T16:27:11Z")
Please try the below filter in your configuration file: filter { grok { pattern =\> ["\A%{WORD:EventType}%{SPACE}%{WORD:EventSubType}%{SPACE}%{INT:Severity}%{SPACE}%{WORD:SARMID}%{NOTSPACE}%{SPACE}%{PROG:EventDate}%{SPACE}%{TIME:EventTime}%{SPACE}%{GREEDYDATA:LogMessage}"] add\_field =\>["timestamp" ,"%{EventDate} %{EventTime}"] } date { match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"] } } Date filter is needed to over ride ElasticSearch's timestamp field with the log file timestamp. Thanks, Vinod ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612/8 "2017-07-06T04:55:12Z")