From 1c7a4d1076ac4b1335120c24c57dbcd1a22a848c Mon Sep 17 00:00:00 2001
From: Thomas Widhalm <thomas.widhalm@netways.de>
Date: Tue, 18 Mar 2025 14:00:42 +0100
Subject: [PATCH] Deal with optional newline in event
---
filter-10-header.conf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/filter-10-header.conf b/filter-10-header.conf
index 87a4efa..426657a 100644
--- a/filter-10-header.conf
+++ b/filter-10-header.conf
@@ -1,7 +1,7 @@
filter {
grok {
- match => ["message", "%{TIMESTAMP_ISO8601:oracledate} %{GREEDYDATA:message}"]
+ match => ["message", "%{TIMESTAMP_ISO8601:oracledate}(\n)?%{SPACE}%{GREEDYDATA:message}"]
tag_on_failure => ["_grokparsefailure", "oracle_header_failed"]
id => "oracle_header"
overwrite => "message"