input { file { path => "../logs/osb_server1-trace.log" start_position => beginning } } filter { multiline { pattern => "^####" negate => true what => "previous" } mutate { gsub => ['message', "\n", " "] } grok { patterns_dir => "./patterns" break_on_match => false match => { "message" => "####<%{DATA:Log_Time}> %{GREEDYDATA}\]\ %{WORD:Trace_Identifier}\|%{INFO:Service_Name}\|%{INFO:Operation_Name}\|%{INFO:Conversation_Identifier}\|%{INFO:Local_Proxy_Name}(\|(?: |%{INFO:Target}))?(\|(?: |%{INFO:Target_Response}))?(\|(?: |%{INFO:Sender_Host}))?(\|(?: |%{INFO:Error_Code}))?(\|(?: |%{INFO:Error_Reason}))?(\|(?: |%{INFO:Error_Details}))?\>" } } } output { stdout { codec => rubydebug } if "_grokparsefailure" not in [tags] { jdbc { driver_class => "oracle.jdbc.driver.OracleDriver" connection_string => "jdbc:oracle:thin:sys as SYSDBA/welcome1@hercules.lcm.local:1521:XE" statement => [ "INSERT INTO hr.osb_trace_log (host, logtimestamp, trace_key, service_name, operation_name, conversation_id, local_proxy_name, target, target_response, sender_host, logtime) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", "host", "@timestamp", "Trace_Identifier", "Service_Name", "Operation_Name", "Conversation_Identifier", "Local_Proxy_Name","Target", "Target_Response", "Sender_Host", "Log_Time" ] } } }