Hi,
I'm sending oracle auditing events with filebeat 5.0.0. The events itself are written to an xml-file by the oracle database.
Sometimes, one field (DB_User) contains a single /.
It'd like to filter this slash in a logstash config. Obviously, it is not possible or I don't know the correct way.
Here is a sample part of the config:
if ([AuditRecord][DB_User]) { mutate { add_tag => ["something"]} if ([AuditRecord][DB_User] == "/") { mutate { add_tag => [ "condition" ] } } if [AuditRecord][DB_User] =~ /\// { mutate { add_tag => [ "regexp" ] } } if [AuditRecord][DB_User] =~ "\/" { mutate { add_tag => [ "regexp_2"] } } if [AuditRecord][DB_User] =~ /^\// { mutate { add_tag => [ "regexp_3"] } }
This config only adds the tag "something". None of the other tags is added.
This is the part of the JSON in Kibana:
"AuditRecord": { "DB_User": [ "/" ],
And when trying to filter with Kibana by pressing the +, it shows following (although there are definitely hits)
Thanks for your help!