sudo cat << EOF | sudo tee /etc/filebeat/filebeat.yml
---
logging.metrics.enabled: false
filebeat.inputs:
- type: log
fields_under_root: true
fields:
log_type: alertLog-oracle
multiline.match: after
multiline.negate: true
multiline.pattern: '(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?) \b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b'
multiline.type: pattern
paths:
- ..../admin/EHR/bdump
- type: log
fields_under_root: true
fields:
log_type: listenerLog-oracle
multiline.match: after
multiline.negate: true
multiline.pattern: '\d{2}-\w{3}-\d{4} \d{2}:\d{2}:\d{2}'
multiline.type: pattern
paths:
- .../network/log/listener.log
- type: log
fields_under_root: true
fields:
log_type: backupLog-oracle
multiline.match: after
multiline.negate: true
multiline.pattern: "^Connected to: Oracle Database 10g Release 10.2.0.5.0 - 64bit Production"
multiline.type: pattern
paths:
- .../exp_bak/file/*.log
output.logstash:
backoff.init: 1s
backoff.max: 60s
bulk_max_size: 128
hosts:
- "logstash IP:5044"
timeout: 1m
EOF