"Logstash"-process data using mutate

Mutate:http://www.logstash.net/docs/1.4.2/filters/mutate

Use Logstash to extract the Ora error from the alter log of Oracle.

The log format is as follows:

ALTER DATABASE openerrors in file d:\oracle\diag\rdbms\hxw168\hxw168\trace\hxw168_ora_6148.trc:ora-01589: To open a database you must use the Resetlogs or Noresetlogs option ORA-1589 signalled During:alter database Open...alter

Logstash content:

input{file{ codec => plain {charset =>  "CP936"   #windows下的编码是cp936 ( CHCP view)}type =>  "Oracleerr" path =>  "D:/logsystem/logstash/bin/test/alert_hxw168.log"    start_position =>  "Beginning"} #stdin {type =>  "Hxwtest"}}filter{ mutate{         #以: Divide the message content and display it in data mode.          #比如abc:efg => message[0] = abc  message[1]=efg        split => ["Message", ":"]}# The content of the first data is ora-xxxxx in this format, which is the Ora error. Add two fields #oraerr oradesif [message][0] =~ /^ora-[0-9]{5}/ {mutate{add_field =>    {  "Oraerr"  =>  "%{[message][0]}"   "Orades"  =>  "%{[message" [1]} "}}}} output{      #有ORAERR字段, the output.      if [oraerr]{    &Nbsp;  stdout{codec => rubydebug}}} 

Results:

1.{        "Message"  => [         [0]  "ORA-00322",        [1]  "  log  2   (for thread  1)   not the latest copy \ r "    ],      " @version "  =>  "1",     "@timestamp"  =>  "2014-12-12t15:50:53.790z",            "type"  =>  "Oracleerr",            "Host"  =>  "Huangwen",            "path"  =>  "D:/logsystem/logstash/bin/test/alert_hxw168.log",          "Oraerr"  =>  "ORA-00322",          "Orades"  =>  "  log  2  (for thread  1)   not the latest copy \ r"}2. {        "MeSsage " => [        [0] " ORA-00312 ",         [1]  "  Online logs  2  thread  1",         [2]  "  D",        [3]  "\\ORACLE\\ Oradata\\hxw168\\redo02. LOG ' \ R '     ],       ' @version '  =>  ' 1 ',      "@timestamp"  =>  "2014-12-12t15:50:53.790z",            "type"  =>  "Oracleerr",            "Host"  =>  "Huangwen",           " Path " => " D:/logsystem/logstash/bin/test/alert_hxw168.log ",          "Oraerr"  =>  "ORA-00312",         "Orades"  =>  "   Online logs  2  thread  1 "}

This article from "Despite the wrong, let me wrong to die!" "Blog, be sure to keep this provenance http://hxw168.blog.51cto.com/8718136/1589498

"Logstash"-process data using mutate