filter-10-header.conf

filter {

  grok {
    match => ["message", "%{TIMESTAMP_ISO8601:oracledate}(\n)?%{SPACE}%{GREEDYDATA:message}"]
    tag_on_failure => ["_grokparsefailure", "oracle_header_failed"]
    id => "oracle_header"
    overwrite => "message"
  }

  date {
    match => ["oracledate", "ISO8601" ]
    id => "oracle_date"
  }

# using a metadata field instead of creating and removing a field would be better
# but since we had some problems with this way I fell back to using create and remove

  mutate {
    remove_field => "oracledate"
    id => "oracle_remove_datefield"
  }
}