I have log4j messages have been pushed to Nagios using rsyslog with aix 7.2. I want to split the message stop at "at oracle.sql....". I write the grok filter like below but it get full message till the end :( How to split the message?
[%{DATA:LOG_LEVEL}] %{TIMESTAMP_ISO8601:timestamp} [%{GREEDYDATA:MSG}] %{DATA:LOGNAME} %{DATA:sessionid} - %{GREEDYDATA:java_msg}
[ERROR] 2020-11-12 14:48:52,997 [WMQJCAResourceAdapter : 18] DATABASE {sessionId=1123863375} - Failed to read record 'ID9560' from 'F_USER_ABBREVIATION' . Returning null. java.sql.SQLException: Invalid character encountered in
at oracle.sql.CharacterSet.failUTFConversion(CharacterSet.java:2900) ~[ojdbc7.jar:12.1.0.1.0]
at oracle.sql.CharacterSetAL32UTF8.toString(CharacterSetAL32UTF8.java:184) ~[ojdbc7.jar:12.1.0.1.0]
at oracle.xdb.XMLType.processString(XMLType.java:3325) ~[xdb.jar:?]
at oracle.xdb.XMLType.processThin(XMLType.java:3450) ~[xdb.jar:?]
at oracle.xdb.XMLType.<init>(XMLType.java:1550) ~[xdb.jar:?]
at com.temenos.t24.CACHE_READ_cl.lbl_LOAD_RECORD(Unknown Source) [EB_DataAccess.jar:R17_AMR.0 java 1.7.0_55-b13 compliant 1.7]*
Aucun commentaire:
Enregistrer un commentaire