API tools faq
paste
Advertisement
bm_rec

filebeat debug

bm_rec
Aug 8th, 2019
687
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 215.14 KB | None | 0 0
raw download clone embed print report
  1. -- Logs begin at Чт 2019-08-08 21:55:12 MSK, end at Чт 2019-08-08 21:58:17 MSK. --
  2. авг 08 21:55:12 server1.local filebeat[10175]: 2019-08-08T21:55:12.682+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  3. авг 08 21:55:13 server1.local filebeat[10175]: 2019-08-08T21:55:13.683+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  4. авг 08 21:55:13 server1.local filebeat[10175]: 2019-08-08T21:55:13.715+0300 DEBUG [input] input/input.go:152 Run input
  5. авг 08 21:55:13 server1.local filebeat[10175]: 2019-08-08T21:55:13.715+0300 DEBUG [input] log/input.go:187 Start next scan
  6. авг 08 21:55:13 server1.local filebeat[10175]: 2019-08-08T21:55:13.715+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  7. авг 08 21:55:13 server1.local filebeat[10175]: 2019-08-08T21:55:13.715+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10021605
  8. авг 08 21:55:13 server1.local filebeat[10175]: 2019-08-08T21:55:13.715+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  9. авг 08 21:55:13 server1.local filebeat[10175]: 2019-08-08T21:55:13.715+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  10. авг 08 21:55:15 server1.local filebeat[10175]: 2019-08-08T21:55:15.683+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  11. авг 08 21:55:16 server1.local filebeat[10175]: 2019-08-08T21:55:16.715+0300 DEBUG [input] input/input.go:152 Run input
  12. авг 08 21:55:16 server1.local filebeat[10175]: 2019-08-08T21:55:16.716+0300 DEBUG [input] log/input.go:187 Start next scan
  13. авг 08 21:55:16 server1.local filebeat[10175]: 2019-08-08T21:55:16.716+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  14. авг 08 21:55:16 server1.local filebeat[10175]: 2019-08-08T21:55:16.716+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10021605
  15. авг 08 21:55:16 server1.local filebeat[10175]: 2019-08-08T21:55:16.716+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  16. авг 08 21:55:16 server1.local filebeat[10175]: 2019-08-08T21:55:16.716+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  17. авг 08 21:55:17 server1.local filebeat[10175]: 2019-08-08T21:55:17.683+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  18. авг 08 21:55:17 server1.local filebeat[10175]: 2019-08-08T21:55:17.684+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  19. авг 08 21:55:17 server1.local filebeat[10175]: "@timestamp": "2019-08-08T18:55:12.682Z",
  20. авг 08 21:55:17 server1.local filebeat[10175]: "@metadata": {
  21. авг 08 21:55:17 server1.local filebeat[10175]: "beat": "filebeat",
  22. авг 08 21:55:17 server1.local filebeat[10175]: "type": "_doc",
  23. авг 08 21:55:17 server1.local filebeat[10175]: "version": "7.2.0"
  24. авг 08 21:55:17 server1.local filebeat[10175]: },
  25. авг 08 21:55:17 server1.local filebeat[10175]: "log": {
  26. авг 08 21:55:17 server1.local filebeat[10175]: "offset": 10021605,
  27. авг 08 21:55:17 server1.local filebeat[10175]: "file": {
  28. авг 08 21:55:17 server1.local filebeat[10175]: "path": "/var/log/weblogic/weblogic.log"
  29. авг 08 21:55:17 server1.local filebeat[10175]: },
  30. авг 08 21:55:17 server1.local filebeat[10175]: "flags": [
  31. авг 08 21:55:17 server1.local filebeat[10175]: "multiline"
  32. авг 08 21:55:17 server1.local filebeat[10175]: ]
  33. авг 08 21:55:17 server1.local filebeat[10175]: },
  34. авг 08 21:55:17 server1.local filebeat[10175]: "component": "app",
  35. авг 08 21:55:17 server1.local filebeat[10175]: "input": {
  36. авг 08 21:55:17 server1.local filebeat[10175]: "type": "log"
  37. авг 08 21:55:17 server1.local filebeat[10175]: },
  38. авг 08 21:55:17 server1.local filebeat[10175]: "env": "test",
  39. авг 08 21:55:17 server1.local filebeat[10175]: "system": "pgp",
  40. авг 08 21:55:17 server1.local filebeat[10175]: "shorthostname": "server1",
  41. авг 08 21:55:17 server1.local filebeat[10175]: "message": "08-08-2019 21:55:10.010 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:10.010 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:10.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:10.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:10.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:10.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:10.023 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:55:10.023 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  42. авг 08 21:55:17 server1.local filebeat[10175]: "host": {
  43. авг 08 21:55:17 server1.local filebeat[10175]: "name": "server1.local",
  44. авг 08 21:55:17 server1.local filebeat[10175]: "architecture": "x86_64",
  45. авг 08 21:55:17 server1.local filebeat[10175]: "os": {
  46. авг 08 21:55:17 server1.local filebeat[10175]: "platform": "rhel",
  47. авг 08 21:55:17 server1.local filebeat[10175]: "version": "7.4 (Maipo)",
  48. авг 08 21:55:17 server1.local filebeat[10175]: "family": "redhat",
  49. авг 08 21:55:17 server1.local filebeat[10175]: "name": "Red Hat Enterprise Linux Server",
  50. авг 08 21:55:17 server1.local filebeat[10175]: "kernel": "3.10.0-1062.el7.x86_64",
  51. авг 08 21:55:17 server1.local filebeat[10175]: "codename": "Maipo"
  52. авг 08 21:55:17 server1.local filebeat[10175]: },
  53. авг 08 21:55:17 server1.local filebeat[10175]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  54. авг 08 21:55:17 server1.local filebeat[10175]: "containerized": false,
  55. авг 08 21:55:17 server1.local filebeat[10175]: "hostname": "server1.local"
  56. авг 08 21:55:17 server1.local filebeat[10175]: },
  57. авг 08 21:55:17 server1.local filebeat[10175]: "agent": {
  58. авг 08 21:55:17 server1.local filebeat[10175]: "type": "filebeat",
  59. авг 08 21:55:17 server1.local filebeat[10175]: "ephemeral_id": "bea9fa61-82c7-4005-a537-abf829ec6b86",
  60. авг 08 21:55:17 server1.local filebeat[10175]: "hostname": "server1.local",
  61. авг 08 21:55:17 server1.local filebeat[10175]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  62. авг 08 21:55:17 server1.local filebeat[10175]: "version": "7.2.0"
  63. авг 08 21:55:17 server1.local filebeat[10175]: },
  64. авг 08 21:55:17 server1.local filebeat[10175]: "ecs": {
  65. авг 08 21:55:17 server1.local filebeat[10175]: "version": "1.0.0"
  66. авг 08 21:55:17 server1.local filebeat[10175]: },
  67. авг 08 21:55:17 server1.local filebeat[10175]: "log_name": "auction"
  68. авг 08 21:55:17 server1.local filebeat[10175]: }
  69. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.686+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  70. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [23: 0, 1]
  71. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=24, end-seq=24
  72. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  73. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  74. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  75. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  76. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  77. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.688+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  78. авг 08 21:55:18 server1.local filebeat[10175]: 2019-08-08T21:55:18.695+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  79. авг 08 21:55:19 server1.local filebeat[10175]: 2019-08-08T21:55:19.684+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  80. авг 08 21:55:19 server1.local filebeat[10175]: 2019-08-08T21:55:19.716+0300 DEBUG [input] input/input.go:152 Run input
  81. авг 08 21:55:19 server1.local filebeat[10175]: 2019-08-08T21:55:19.716+0300 DEBUG [input] log/input.go:187 Start next scan
  82. авг 08 21:55:19 server1.local filebeat[10175]: 2019-08-08T21:55:19.717+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  83. авг 08 21:55:19 server1.local filebeat[10175]: 2019-08-08T21:55:19.717+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10022437
  84. авг 08 21:55:19 server1.local filebeat[10175]: 2019-08-08T21:55:19.717+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  85. авг 08 21:55:19 server1.local filebeat[10175]: 2019-08-08T21:55:19.717+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  86. авг 08 21:55:22 server1.local filebeat[10175]: 2019-08-08T21:55:22.717+0300 DEBUG [input] input/input.go:152 Run input
  87. авг 08 21:55:22 server1.local filebeat[10175]: 2019-08-08T21:55:22.718+0300 DEBUG [input] log/input.go:187 Start next scan
  88. авг 08 21:55:22 server1.local filebeat[10175]: 2019-08-08T21:55:22.718+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  89. авг 08 21:55:22 server1.local filebeat[10175]: 2019-08-08T21:55:22.719+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10022437
  90. авг 08 21:55:22 server1.local filebeat[10175]: 2019-08-08T21:55:22.719+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  91. авг 08 21:55:22 server1.local filebeat[10175]: 2019-08-08T21:55:22.719+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  92. авг 08 21:55:25 server1.local filebeat[10175]: 2019-08-08T21:55:25.719+0300 DEBUG [input] input/input.go:152 Run input
  93. авг 08 21:55:25 server1.local filebeat[10175]: 2019-08-08T21:55:25.720+0300 DEBUG [input] log/input.go:187 Start next scan
  94. авг 08 21:55:25 server1.local filebeat[10175]: 2019-08-08T21:55:25.720+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  95. авг 08 21:55:25 server1.local filebeat[10175]: 2019-08-08T21:55:25.720+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10022437
  96. авг 08 21:55:25 server1.local filebeat[10175]: 2019-08-08T21:55:25.720+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  97. авг 08 21:55:25 server1.local filebeat[10175]: 2019-08-08T21:55:25.720+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  98. авг 08 21:55:27 server1.local filebeat[10175]: 2019-08-08T21:55:27.686+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  99. авг 08 21:55:28 server1.local systemd[1]: Stopping Filebeat sends log files to Logstash or directly to Elasticsearch....
  100. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.226+0300 DEBUG [service] service/service.go:53 Received sigterm/sigint, stopping
  101. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.227+0300 INFO beater/filebeat.go:433 Stopping filebeat
  102. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.227+0300 INFO crawler/crawler.go:139 Stopping Crawler
  103. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.227+0300 INFO crawler/crawler.go:149 Stopping 1 inputs
  104. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.227+0300 INFO cfgfile/reload.go:230 Dynamic config reloader stopped
  105. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.227+0300 INFO input/input.go:149 input ticker stopped
  106. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.227+0300 INFO input/input.go:167 Stopping Input: 9186049125118755254
  107. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 INFO harvester/forwarder.go:52 Input outlet closed
  108. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [harvester] log/harvester.go:507 Stopping harvester for file: /var/log/weblogic/weblogic.log
  109. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [harvester] log/harvester.go:517 Closing file: /var/log/weblogic/weblogic.log
  110. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [harvester] log/harvester.go:391 Update state: /var/log/weblogic/weblogic.log, offset: 10022437
  111. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [harvester] log/harvester.go:528 harvester cleanup finished for file: /var/log/weblogic/weblogic.log
  112. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [publisher] pipeline/client.go:149 client: closing acker
  113. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [publisher] pipeline/client.go:151 client: done closing acker
  114. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [publisher] pipeline/client.go:155 client: cancelled 0 events
  115. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 INFO crawler/crawler.go:165 Crawler stopped
  116. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 INFO registrar/registrar.go:367 Stopping Registrar
  117. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 INFO registrar/registrar.go:293 Ending Registrar
  118. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.228+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  119. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.235+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  120. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.240+0300 INFO [monitoring] log/log.go:153 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":220,"time":{"ms":226}},"total":{"ticks":590,"time":{"ms":600},"value":590},"user":{"ticks":370,"time":{"ms":374}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":6},"info":{"ephemeral_id":"bea9fa61-82c7-4005-a537-abf829ec6b86","uptime":{"ms":320656}},"memstats":{"gc_next":4194304,"memory_alloc":2088112,"memory_total":49306000,"rss":27619328},"runtime":{"goroutines":11}},"filebeat":{"events":{"added":26,"done":26},"harvester":{"closed":1,"open_files":0,"running":0,"started":1}},"libbeat":{"config":{"module":{"running":0},"reloads":1},"output":{"events":{"acked":24,"batches":24,"total":24},"read":{"bytes":150},"type":"logstash","write":{"bytes":19457}},"pipeline":{"clients":0,"events":{"active":0,"filtered":2,"published":24,"retry":1,"total":26},"queue":{"acked":24}}},"registrar":{"states":{"current":5,"update":26},"writes":{"success":27,"total":27}},"system":{"cpu":{"cores":4},"load":{"1":0.1,"15":0.15,"5":0.18,"norm":{"1":0.025,"15":0.0375,"5":0.045}}}}}}
  121. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.241+0300 INFO [monitoring] log/log.go:154 Uptime: 5m20.658033954s
  122. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.241+0300 INFO [monitoring] log/log.go:131 Stopping metrics logging.
  123. авг 08 21:55:28 server1.local filebeat[10175]: 2019-08-08T21:55:28.241+0300 INFO instance/beat.go:431 filebeat stopped.
  124. авг 08 21:55:28 server1.local systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
  125. авг 08 21:55:28 server1.local systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
  126. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.328+0300 INFO instance/beat.go:606 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
  127. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.328+0300 DEBUG [beat] instance/beat.go:658 Beat metadata path: /var/lib/filebeat/meta.json
  128. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.328+0300 INFO instance/beat.go:614 Beat ID: 38a4b45d-f325-4c19-9bcf-79b583cdaefe
  129. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.331+0300 DEBUG [processors] processors/processor.go:93 Generated new processors: add_host_metadata=[netinfo.enabled=[false], cache.ttl=[5m0s]]
  130. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.331+0300 DEBUG [seccomp] seccomp/seccomp.go:109 Loading syscall filter {"seccomp_filter": {"no_new_privs":true,"flag":"tsync","policy":{"default_action":"errno","syscalls":[{"names":["accept","accept4","access","arch_prctl","bind","brk","clock_gettime","clone","close","connect","dup","dup2","epoll_create","epoll_create1","epoll_ctl","epoll_pwait","epoll_wait","exit","exit_group","fchdir","fchmod","fchown","fcntl","fdatasync","flock","fstat","fstatfs","fsync","ftruncate","futex","getcwd","getdents","getdents64","geteuid","getgid","getpeername","getpid","getppid","getrandom","getrlimit","getrusage","getsockname","getsockopt","gettid","gettimeofday","getuid","inotify_add_watch","inotify_init1","inotify_rm_watch","ioctl","kill","listen","lseek","lstat","madvise","mincore","mkdirat","mmap","mprotect","munmap","nanosleep","newfstatat","open","openat","pipe","pipe2","poll","ppoll","pread64","pselect6","pwrite64","read","readlink","readlinkat","recvfrom","recvmmsg","recvmsg","rename","renameat","rt_sigaction","rt_sigprocmask","rt_sigreturn","sched_getaffinity","sched_yield","sendfile","sendmmsg","sendmsg","sendto","set_robust_list","setitimer","setsockopt","shutdown","sigaltstack","socket","splice","stat","statfs","sysinfo","tgkill","time","tkill","uname","unlink","unlinkat","wait4","waitid","write","writev"],"action":"allow"}]}}}
  131. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.331+0300 INFO [seccomp] seccomp/seccomp.go:116 Syscall filter successfully installed
  132. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.332+0300 INFO [beat] instance/beat.go:902 Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "38a4b45d-f325-4c19-9bcf-79b583cdaefe"}}}
  133. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.332+0300 INFO [beat] instance/beat.go:911 Build info {"system_info": {"build": {"commit": "9ba65d864ca37cd32c25b980dbb4020975288fc0", "libbeat": "7.2.0", "time": "2019-06-20T15:05:30.000Z", "version": "7.2.0"}}}
  134. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.332+0300 INFO [beat] instance/beat.go:914 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.12.4"}}}
  135. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.333+0300 INFO [beat] instance/beat.go:918 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2019-08-07T12:53:22+03:00","containerized":false,"name":"server1.local","ip":["127.0.0.1/8","::1/128","10.65.60.165/28","fe80::21a:4aff:fe16:1a5/64"],"kernel_version":"3.10.0-1062.el7.x86_64","mac":["00:1a:4a:16:01:a5"],"os":{"family":"redhat","platform":"rhel","name":"Red Hat Enterprise Linux Server","version":"7.4 (Maipo)","major":7,"minor":4,"patch":0,"codename":"Maipo"},"timezone":"MSK","timezone_offset_sec":10800,"id":"8930f2efbd4a4e75a22237a0c20f8f41"}}}
  136. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.334+0300 INFO [beat] instance/beat.go:947 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"ambient":null}, "cwd": "/", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 10446, "ppid": 1, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2019-08-08T21:55:27.920+0300"}}}
  137. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.334+0300 INFO instance/beat.go:292 Setup Beat: filebeat; Version: 7.2.0
  138. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.334+0300 DEBUG [beat] instance/beat.go:318 Initializing output plugins
  139. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.335+0300 DEBUG [publisher] pipeline/consumer.go:137 start pipeline event consumer
  140. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.336+0300 INFO [publisher] pipeline/module.go:97 Beat name: server1.local
  141. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.337+0300 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
  142. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 INFO instance/beat.go:421 filebeat start running.
  143. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 DEBUG [test] registrar/migrate.go:159 isFile(/var/lib/filebeat/registry) -> false
  144. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 DEBUG [test] registrar/migrate.go:159 isFile() -> false
  145. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 DEBUG [test] registrar/migrate.go:152 isDir(/var/lib/filebeat/registry/filebeat) -> true
  146. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 DEBUG [test] registrar/migrate.go:159 isFile(/var/lib/filebeat/registry/filebeat/meta.json) -> true
  147. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 DEBUG [registrar] registrar/migrate.go:51 Registry type '0' found
  148. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 DEBUG [registrar] registrar/registrar.go:125 Registry file set to: /var/lib/filebeat/registry/filebeat/data.json
  149. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.338+0300 INFO registrar/registrar.go:145 Loading registrar data from /var/lib/filebeat/registry/filebeat/data.json
  150. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.339+0300 INFO registrar/registrar.go:152 States Loaded from registrar: 5
  151. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.339+0300 WARN beater/filebeat.go:358 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
  152. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.339+0300 INFO crawler/crawler.go:72 Loading Inputs: 1
  153. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.339+0300 DEBUG [registrar] registrar/registrar.go:278 Starting Registrar
  154. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.339+0300 DEBUG [input] log/config.go:204 recursive glob enabled
  155. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [input] log/input.go:160 exclude_files: []. Number of stats: 5
  156. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [input] file/states.go:68 New state added for /var/log/weblogic/weblogic.log
  157. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [publisher] pipeline/client.go:200 Pipeline client receives callback 'onFilteredOut' for event: %+v{0001-01-01 00:00:00 +0000 UTC null null {29384197-64776 true <nil> /var/log/weblogic/weblogic.log 10022437 2019-08-08 21:55:18.688730504 +0300 MSK -1ns log map[] 29384197-64776} false}
  158. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [input] log/input.go:181 input with previous states loaded: 1
  159. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 INFO log/input.go:148 Configured paths: [/var/log/weblogic/weblogic.log]
  160. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 INFO input/input.go:114 Starting input of type: log; ID: 9186049125118755254
  161. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [cfgfile] cfgfile/reload.go:134 Checking module configs from: /etc/filebeat/modules.d/*.yml
  162. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  163. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  164. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  165. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [registrar] registrar/registrar.go:346 Registrar states cleaned up. Before: 5, After: 5, Pending: 0
  166. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.340+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  167. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [cfgfile] cfgfile/reload.go:148 Number of module configs found: 0
  168. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 INFO crawler/crawler.go:106 Loading and starting Inputs completed. Enabled inputs: 1
  169. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [input] log/input.go:187 Start next scan
  170. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 INFO cfgfile/reload.go:172 Config reloader started
  171. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [cfgfile] cfgfile/reload.go:198 Scan for new config files
  172. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  173. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10022437
  174. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [input] log/input.go:516 Resuming harvesting of file: /var/log/weblogic/weblogic.log, offset: 10022437, new size: 10023269
  175. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [cfgfile] cfgfile/reload.go:217 Number of module configs found: 0
  176. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [reload] cfgfile/list.go:62 Starting reload procedure, current runners: 0
  177. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [reload] cfgfile/list.go:80 Start list: 0, Stop list: 0
  178. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 INFO cfgfile/reload.go:227 Loading of config files completed.
  179. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [harvester] log/harvester.go:481 Set previous offset for file: /var/log/weblogic/weblogic.log. Offset: 10022437
  180. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.341+0300 DEBUG [harvester] log/harvester.go:472 Setting offset for file: /var/log/weblogic/weblogic.log. Offset: 10022437
  181. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.342+0300 DEBUG [harvester] log/harvester.go:183 Harvester setup successful. Line terminator: 1
  182. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.342+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  183. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.342+0300 DEBUG [publisher] pipeline/client.go:200 Pipeline client receives callback 'onFilteredOut' for event: %+v{0001-01-01 00:00:00 +0000 UTC null null { false 0xc000374ea0 /var/log/weblogic/weblogic.log 10022437 2019-08-08 21:55:28.341376765 +0300 MSK m=+0.067755462 -1ns log map[] 29384197-64776} false}
  184. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.342+0300 DEBUG [harvester] log/harvester.go:391 Update state: /var/log/weblogic/weblogic.log, offset: 10022437
  185. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.342+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  186. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.342+0300 INFO log/harvester.go:253 Harvester started for file: /var/log/weblogic/weblogic.log
  187. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.342+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  188. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.345+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  189. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.345+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  190. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.345+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  191. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.345+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  192. авг 08 21:55:28 server1.local filebeat[10446]: 2019-08-08T21:55:28.349+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  193. авг 08 21:55:29 server1.local filebeat[10446]: 2019-08-08T21:55:29.343+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  194. авг 08 21:55:31 server1.local filebeat[10446]: 2019-08-08T21:55:31.343+0300 DEBUG [input] input/input.go:152 Run input
  195. авг 08 21:55:31 server1.local filebeat[10446]: 2019-08-08T21:55:31.343+0300 DEBUG [input] log/input.go:187 Start next scan
  196. авг 08 21:55:31 server1.local filebeat[10446]: 2019-08-08T21:55:31.344+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  197. авг 08 21:55:31 server1.local filebeat[10446]: 2019-08-08T21:55:31.344+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  198. авг 08 21:55:31 server1.local filebeat[10446]: 2019-08-08T21:55:31.344+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10022437
  199. авг 08 21:55:31 server1.local filebeat[10446]: 2019-08-08T21:55:31.344+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  200. авг 08 21:55:31 server1.local filebeat[10446]: 2019-08-08T21:55:31.345+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  201. авг 08 21:55:32 server1.local filebeat[10446]: 2019-08-08T21:55:32.344+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  202. авг 08 21:55:34 server1.local filebeat[10446]: 2019-08-08T21:55:34.345+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  203. авг 08 21:55:34 server1.local filebeat[10446]: 2019-08-08T21:55:34.345+0300 DEBUG [input] input/input.go:152 Run input
  204. авг 08 21:55:34 server1.local filebeat[10446]: 2019-08-08T21:55:34.346+0300 DEBUG [input] log/input.go:187 Start next scan
  205. авг 08 21:55:34 server1.local filebeat[10446]: 2019-08-08T21:55:34.346+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  206. авг 08 21:55:34 server1.local filebeat[10446]: 2019-08-08T21:55:34.346+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10022437
  207. авг 08 21:55:34 server1.local filebeat[10446]: 2019-08-08T21:55:34.346+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  208. авг 08 21:55:34 server1.local filebeat[10446]: 2019-08-08T21:55:34.346+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  209. авг 08 21:55:36 server1.local filebeat[10446]: 2019-08-08T21:55:36.344+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  210. авг 08 21:55:36 server1.local filebeat[10446]: 2019-08-08T21:55:36.347+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  211. авг 08 21:55:36 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:55:28.342Z",
  212. авг 08 21:55:36 server1.local filebeat[10446]: "@metadata": {
  213. авг 08 21:55:36 server1.local filebeat[10446]: "beat": "filebeat",
  214. авг 08 21:55:36 server1.local filebeat[10446]: "type": "_doc",
  215. авг 08 21:55:36 server1.local filebeat[10446]: "version": "7.2.0"
  216. авг 08 21:55:36 server1.local filebeat[10446]: },
  217. авг 08 21:55:36 server1.local filebeat[10446]: "env": "test",
  218. авг 08 21:55:36 server1.local filebeat[10446]: "input": {
  219. авг 08 21:55:36 server1.local filebeat[10446]: "type": "log"
  220. авг 08 21:55:36 server1.local filebeat[10446]: },
  221. авг 08 21:55:36 server1.local filebeat[10446]: "shorthostname": "server1",
  222. авг 08 21:55:36 server1.local filebeat[10446]: "ecs": {
  223. авг 08 21:55:36 server1.local filebeat[10446]: "version": "1.0.0"
  224. авг 08 21:55:36 server1.local filebeat[10446]: },
  225. авг 08 21:55:36 server1.local filebeat[10446]: "log": {
  226. авг 08 21:55:36 server1.local filebeat[10446]: "file": {
  227. авг 08 21:55:36 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  228. авг 08 21:55:36 server1.local filebeat[10446]: },
  229. авг 08 21:55:36 server1.local filebeat[10446]: "flags": [
  230. авг 08 21:55:36 server1.local filebeat[10446]: "multiline"
  231. авг 08 21:55:36 server1.local filebeat[10446]: ],
  232. авг 08 21:55:36 server1.local filebeat[10446]: "offset": 10022437
  233. авг 08 21:55:36 server1.local filebeat[10446]: },
  234. авг 08 21:55:36 server1.local filebeat[10446]: "message": "08-08-2019 21:55:20.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:20.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:20.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:20.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:20.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:20.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:20.016 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:55:20.016 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:55:30.024 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:30.024 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:30.027 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:30.027 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:30.027 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:30.027 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:30.040 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:55:30.040 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  235. авг 08 21:55:36 server1.local filebeat[10446]: "component": "app",
  236. авг 08 21:55:36 server1.local filebeat[10446]: "system": "pgp",
  237. авг 08 21:55:36 server1.local filebeat[10446]: "log_name": "auction",
  238. авг 08 21:55:36 server1.local filebeat[10446]: "host": {
  239. авг 08 21:55:36 server1.local filebeat[10446]: "name": "server1.local",
  240. авг 08 21:55:36 server1.local filebeat[10446]: "architecture": "x86_64",
  241. авг 08 21:55:36 server1.local filebeat[10446]: "os": {
  242. авг 08 21:55:36 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  243. авг 08 21:55:36 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  244. авг 08 21:55:36 server1.local filebeat[10446]: "codename": "Maipo",
  245. авг 08 21:55:36 server1.local filebeat[10446]: "platform": "rhel",
  246. авг 08 21:55:36 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  247. авг 08 21:55:36 server1.local filebeat[10446]: "family": "redhat"
  248. авг 08 21:55:36 server1.local filebeat[10446]: },
  249. авг 08 21:55:36 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  250. авг 08 21:55:36 server1.local filebeat[10446]: "containerized": false,
  251. авг 08 21:55:36 server1.local filebeat[10446]: "hostname": "server1.local"
  252. авг 08 21:55:36 server1.local filebeat[10446]: },
  253. авг 08 21:55:36 server1.local filebeat[10446]: "agent": {
  254. авг 08 21:55:36 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  255. авг 08 21:55:36 server1.local filebeat[10446]: "version": "7.2.0",
  256. авг 08 21:55:36 server1.local filebeat[10446]: "type": "filebeat",
  257. авг 08 21:55:36 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  258. авг 08 21:55:36 server1.local filebeat[10446]: "hostname": "server1.local"
  259. авг 08 21:55:36 server1.local filebeat[10446]: }
  260. авг 08 21:55:36 server1.local filebeat[10446]: }
  261. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.347+0300 DEBUG [input] input/input.go:152 Run input
  262. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.347+0300 DEBUG [input] log/input.go:187 Start next scan
  263. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.348+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  264. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.348+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10024101
  265. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.348+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  266. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.348+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  267. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.353+0300 INFO pipeline/output.go:95 Connecting to backoff(async(tcp://logstash:3090))
  268. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.353+0300 DEBUG [logstash] logstash/async.go:111 connect
  269. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.359+0300 INFO pipeline/output.go:105 Connection to backoff(async(tcp://logstash:3090)) established
  270. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.364+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  271. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.366+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [0: 0, 1]
  272. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.366+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=1, end-seq=1
  273. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.366+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  274. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.366+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  275. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.366+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  276. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.367+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  277. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.367+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  278. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.367+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  279. авг 08 21:55:37 server1.local filebeat[10446]: 2019-08-08T21:55:37.374+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  280. авг 08 21:55:38 server1.local filebeat[10446]: 2019-08-08T21:55:38.347+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  281. авг 08 21:55:40 server1.local filebeat[10446]: 2019-08-08T21:55:40.349+0300 DEBUG [input] input/input.go:152 Run input
  282. авг 08 21:55:40 server1.local filebeat[10446]: 2019-08-08T21:55:40.350+0300 DEBUG [input] log/input.go:187 Start next scan
  283. авг 08 21:55:40 server1.local filebeat[10446]: 2019-08-08T21:55:40.350+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  284. авг 08 21:55:40 server1.local filebeat[10446]: 2019-08-08T21:55:40.350+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10024101
  285. авг 08 21:55:40 server1.local filebeat[10446]: 2019-08-08T21:55:40.351+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  286. авг 08 21:55:40 server1.local filebeat[10446]: 2019-08-08T21:55:40.351+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  287. авг 08 21:55:43 server1.local filebeat[10446]: 2019-08-08T21:55:43.351+0300 DEBUG [input] input/input.go:152 Run input
  288. авг 08 21:55:43 server1.local filebeat[10446]: 2019-08-08T21:55:43.351+0300 DEBUG [input] log/input.go:187 Start next scan
  289. авг 08 21:55:43 server1.local filebeat[10446]: 2019-08-08T21:55:43.351+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  290. авг 08 21:55:43 server1.local filebeat[10446]: 2019-08-08T21:55:43.352+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10024101
  291. авг 08 21:55:43 server1.local filebeat[10446]: 2019-08-08T21:55:43.352+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  292. авг 08 21:55:43 server1.local filebeat[10446]: 2019-08-08T21:55:43.352+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  293. авг 08 21:55:46 server1.local filebeat[10446]: 2019-08-08T21:55:46.348+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  294. авг 08 21:55:46 server1.local filebeat[10446]: 2019-08-08T21:55:46.352+0300 DEBUG [input] input/input.go:152 Run input
  295. авг 08 21:55:46 server1.local filebeat[10446]: 2019-08-08T21:55:46.352+0300 DEBUG [input] log/input.go:187 Start next scan
  296. авг 08 21:55:46 server1.local filebeat[10446]: 2019-08-08T21:55:46.352+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  297. авг 08 21:55:46 server1.local filebeat[10446]: 2019-08-08T21:55:46.352+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10024101
  298. авг 08 21:55:46 server1.local filebeat[10446]: 2019-08-08T21:55:46.352+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  299. авг 08 21:55:46 server1.local filebeat[10446]: 2019-08-08T21:55:46.352+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  300. авг 08 21:55:47 server1.local filebeat[10446]: 2019-08-08T21:55:47.350+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  301. авг 08 21:55:49 server1.local filebeat[10446]: 2019-08-08T21:55:49.351+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  302. авг 08 21:55:49 server1.local filebeat[10446]: 2019-08-08T21:55:49.353+0300 DEBUG [input] input/input.go:152 Run input
  303. авг 08 21:55:49 server1.local filebeat[10446]: 2019-08-08T21:55:49.353+0300 DEBUG [input] log/input.go:187 Start next scan
  304. авг 08 21:55:49 server1.local filebeat[10446]: 2019-08-08T21:55:49.353+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  305. авг 08 21:55:49 server1.local filebeat[10446]: 2019-08-08T21:55:49.353+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10024101
  306. авг 08 21:55:49 server1.local filebeat[10446]: 2019-08-08T21:55:49.353+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  307. авг 08 21:55:49 server1.local filebeat[10446]: 2019-08-08T21:55:49.353+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  308. авг 08 21:55:51 server1.local filebeat[10446]: 2019-08-08T21:55:51.349+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  309. авг 08 21:55:51 server1.local filebeat[10446]: 2019-08-08T21:55:51.351+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  310. авг 08 21:55:51 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:55:46.348Z",
  311. авг 08 21:55:51 server1.local filebeat[10446]: "@metadata": {
  312. авг 08 21:55:51 server1.local filebeat[10446]: "beat": "filebeat",
  313. авг 08 21:55:51 server1.local filebeat[10446]: "type": "_doc",
  314. авг 08 21:55:51 server1.local filebeat[10446]: "version": "7.2.0"
  315. авг 08 21:55:51 server1.local filebeat[10446]: },
  316. авг 08 21:55:51 server1.local filebeat[10446]: "input": {
  317. авг 08 21:55:51 server1.local filebeat[10446]: "type": "log"
  318. авг 08 21:55:51 server1.local filebeat[10446]: },
  319. авг 08 21:55:51 server1.local filebeat[10446]: "system": "pgp",
  320. авг 08 21:55:51 server1.local filebeat[10446]: "message": "08-08-2019 21:55:40.012 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:40.012 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:40.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:40.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:40.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:40.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:40.022 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:55:40.022 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  321. авг 08 21:55:51 server1.local filebeat[10446]: "component": "app",
  322. авг 08 21:55:51 server1.local filebeat[10446]: "env": "test",
  323. авг 08 21:55:51 server1.local filebeat[10446]: "agent": {
  324. авг 08 21:55:51 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  325. авг 08 21:55:51 server1.local filebeat[10446]: "version": "7.2.0",
  326. авг 08 21:55:51 server1.local filebeat[10446]: "type": "filebeat",
  327. авг 08 21:55:51 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  328. авг 08 21:55:51 server1.local filebeat[10446]: "hostname": "server1.local"
  329. авг 08 21:55:51 server1.local filebeat[10446]: },
  330. авг 08 21:55:51 server1.local filebeat[10446]: "ecs": {
  331. авг 08 21:55:51 server1.local filebeat[10446]: "version": "1.0.0"
  332. авг 08 21:55:51 server1.local filebeat[10446]: },
  333. авг 08 21:55:51 server1.local filebeat[10446]: "host": {
  334. авг 08 21:55:51 server1.local filebeat[10446]: "name": "server1.local",
  335. авг 08 21:55:51 server1.local filebeat[10446]: "os": {
  336. авг 08 21:55:51 server1.local filebeat[10446]: "family": "redhat",
  337. авг 08 21:55:51 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  338. авг 08 21:55:51 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  339. авг 08 21:55:51 server1.local filebeat[10446]: "codename": "Maipo",
  340. авг 08 21:55:51 server1.local filebeat[10446]: "platform": "rhel",
  341. авг 08 21:55:51 server1.local filebeat[10446]: "version": "7.4 (Maipo)"
  342. авг 08 21:55:51 server1.local filebeat[10446]: },
  343. авг 08 21:55:51 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  344. авг 08 21:55:51 server1.local filebeat[10446]: "containerized": false,
  345. авг 08 21:55:51 server1.local filebeat[10446]: "hostname": "server1.local",
  346. авг 08 21:55:51 server1.local filebeat[10446]: "architecture": "x86_64"
  347. авг 08 21:55:51 server1.local filebeat[10446]: },
  348. авг 08 21:55:51 server1.local filebeat[10446]: "log": {
  349. авг 08 21:55:51 server1.local filebeat[10446]: "offset": 10024101,
  350. авг 08 21:55:51 server1.local filebeat[10446]: "file": {
  351. авг 08 21:55:51 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  352. авг 08 21:55:51 server1.local filebeat[10446]: },
  353. авг 08 21:55:51 server1.local filebeat[10446]: "flags": [
  354. авг 08 21:55:51 server1.local filebeat[10446]: "multiline"
  355. авг 08 21:55:51 server1.local filebeat[10446]: ]
  356. авг 08 21:55:51 server1.local filebeat[10446]: },
  357. авг 08 21:55:51 server1.local filebeat[10446]: "log_name": "auction",
  358. авг 08 21:55:51 server1.local filebeat[10446]: "shorthostname": "server1"
  359. авг 08 21:55:51 server1.local filebeat[10446]: }
  360. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.353+0300 DEBUG [input] input/input.go:152 Run input
  361. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.354+0300 DEBUG [input] log/input.go:187 Start next scan
  362. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.354+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  363. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.354+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10024933
  364. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.354+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  365. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.354+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  366. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.356+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  367. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.357+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [1: 0, 1]
  368. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.357+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=2, end-seq=2
  369. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.357+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  370. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.357+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  371. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.357+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  372. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.357+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  373. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.357+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  374. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.358+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  375. авг 08 21:55:52 server1.local filebeat[10446]: 2019-08-08T21:55:52.363+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  376. авг 08 21:55:53 server1.local filebeat[10446]: 2019-08-08T21:55:53.352+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  377. авг 08 21:55:54 server1.local filebeat[10446]: 2019-08-08T21:55:54.352+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  378. авг 08 21:55:55 server1.local filebeat[10446]: 2019-08-08T21:55:55.354+0300 DEBUG [input] input/input.go:152 Run input
  379. авг 08 21:55:55 server1.local filebeat[10446]: 2019-08-08T21:55:55.354+0300 DEBUG [input] log/input.go:187 Start next scan
  380. авг 08 21:55:55 server1.local filebeat[10446]: 2019-08-08T21:55:55.354+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  381. авг 08 21:55:55 server1.local filebeat[10446]: 2019-08-08T21:55:55.355+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10024933
  382. авг 08 21:55:55 server1.local filebeat[10446]: 2019-08-08T21:55:55.355+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  383. авг 08 21:55:55 server1.local filebeat[10446]: 2019-08-08T21:55:55.355+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  384. авг 08 21:55:56 server1.local filebeat[10446]: 2019-08-08T21:55:56.353+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  385. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.345+0300 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":70,"time":{"ms":80}},"total":{"ticks":180,"time":{"ms":191},"value":180},"user":{"ticks":110,"time":{"ms":111}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":7},"info":{"ephemeral_id":"ff21c997-2f19-4d77-ac3d-a9757df39597","uptime":{"ms":30059}},"memstats":{"gc_next":4194304,"memory_alloc":4989520,"memory_total":9936560,"rss":27729920},"runtime":{"goroutines":26}},"filebeat":{"events":{"added":4,"done":4},"harvester":{"open_files":1,"running":1,"started":1}},"libbeat":{"config":{"module":{"running":0},"reloads":1},"output":{"events":{"acked":2,"batches":2,"total":2},"read":{"bytes":12},"type":"logstash","write":{"bytes":1539}},"pipeline":{"clients":1,"events":{"active":0,"filtered":2,"published":2,"retry":1,"total":4},"queue":{"acked":2}}},"registrar":{"states":{"current":5,"update":4},"writes":{"success":4,"total":4}},"system":{"cpu":{"cores":4},"load":{"1":0.31,"15":0.17,"5":0.22,"norm":{"1":0.0775,"15":0.0425,"5":0.055}}}}}}
  386. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.352+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  387. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.352+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  388. авг 08 21:55:58 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:55:53.352Z",
  389. авг 08 21:55:58 server1.local filebeat[10446]: "@metadata": {
  390. авг 08 21:55:58 server1.local filebeat[10446]: "beat": "filebeat",
  391. авг 08 21:55:58 server1.local filebeat[10446]: "type": "_doc",
  392. авг 08 21:55:58 server1.local filebeat[10446]: "version": "7.2.0"
  393. авг 08 21:55:58 server1.local filebeat[10446]: },
  394. авг 08 21:55:58 server1.local filebeat[10446]: "log": {
  395. авг 08 21:55:58 server1.local filebeat[10446]: "offset": 10024933,
  396. авг 08 21:55:58 server1.local filebeat[10446]: "file": {
  397. авг 08 21:55:58 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  398. авг 08 21:55:58 server1.local filebeat[10446]: },
  399. авг 08 21:55:58 server1.local filebeat[10446]: "flags": [
  400. авг 08 21:55:58 server1.local filebeat[10446]: "multiline"
  401. авг 08 21:55:58 server1.local filebeat[10446]: ]
  402. авг 08 21:55:58 server1.local filebeat[10446]: },
  403. авг 08 21:55:58 server1.local filebeat[10446]: "system": "pgp",
  404. авг 08 21:55:58 server1.local filebeat[10446]: "component": "app",
  405. авг 08 21:55:58 server1.local filebeat[10446]: "host": {
  406. авг 08 21:55:58 server1.local filebeat[10446]: "name": "server1.local",
  407. авг 08 21:55:58 server1.local filebeat[10446]: "hostname": "server1.local",
  408. авг 08 21:55:58 server1.local filebeat[10446]: "architecture": "x86_64",
  409. авг 08 21:55:58 server1.local filebeat[10446]: "os": {
  410. авг 08 21:55:58 server1.local filebeat[10446]: "codename": "Maipo",
  411. авг 08 21:55:58 server1.local filebeat[10446]: "platform": "rhel",
  412. авг 08 21:55:58 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  413. авг 08 21:55:58 server1.local filebeat[10446]: "family": "redhat",
  414. авг 08 21:55:58 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  415. авг 08 21:55:58 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64"
  416. авг 08 21:55:58 server1.local filebeat[10446]: },
  417. авг 08 21:55:58 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  418. авг 08 21:55:58 server1.local filebeat[10446]: "containerized": false
  419. авг 08 21:55:58 server1.local filebeat[10446]: },
  420. авг 08 21:55:58 server1.local filebeat[10446]: "ecs": {
  421. авг 08 21:55:58 server1.local filebeat[10446]: "version": "1.0.0"
  422. авг 08 21:55:58 server1.local filebeat[10446]: },
  423. авг 08 21:55:58 server1.local filebeat[10446]: "message": "08-08-2019 21:55:50.024 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:50.024 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:55:50.026 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:50.026 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:55:50.026 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:50.026 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:55:50.030 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:55:50.030 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  424. авг 08 21:55:58 server1.local filebeat[10446]: "input": {
  425. авг 08 21:55:58 server1.local filebeat[10446]: "type": "log"
  426. авг 08 21:55:58 server1.local filebeat[10446]: },
  427. авг 08 21:55:58 server1.local filebeat[10446]: "log_name": "auction",
  428. авг 08 21:55:58 server1.local filebeat[10446]: "shorthostname": "server1",
  429. авг 08 21:55:58 server1.local filebeat[10446]: "env": "test",
  430. авг 08 21:55:58 server1.local filebeat[10446]: "agent": {
  431. авг 08 21:55:58 server1.local filebeat[10446]: "hostname": "server1.local",
  432. авг 08 21:55:58 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  433. авг 08 21:55:58 server1.local filebeat[10446]: "version": "7.2.0",
  434. авг 08 21:55:58 server1.local filebeat[10446]: "type": "filebeat",
  435. авг 08 21:55:58 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597"
  436. авг 08 21:55:58 server1.local filebeat[10446]: }
  437. авг 08 21:55:58 server1.local filebeat[10446]: }
  438. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.355+0300 DEBUG [input] input/input.go:152 Run input
  439. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.355+0300 DEBUG [input] log/input.go:187 Start next scan
  440. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.355+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  441. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.355+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10025765
  442. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.355+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  443. авг 08 21:55:58 server1.local filebeat[10446]: 2019-08-08T21:55:58.355+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  444. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.355+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  445. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.356+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [2: 0, 1]
  446. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.356+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=3, end-seq=3
  447. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.356+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  448. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.356+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  449. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.356+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  450. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.356+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  451. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.357+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  452. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.357+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  453. авг 08 21:55:59 server1.local filebeat[10446]: 2019-08-08T21:55:59.360+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  454. авг 08 21:56:00 server1.local filebeat[10446]: 2019-08-08T21:56:00.354+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  455. авг 08 21:56:01 server1.local filebeat[10446]: 2019-08-08T21:56:01.355+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  456. авг 08 21:56:01 server1.local filebeat[10446]: 2019-08-08T21:56:01.356+0300 DEBUG [input] input/input.go:152 Run input
  457. авг 08 21:56:01 server1.local filebeat[10446]: 2019-08-08T21:56:01.356+0300 DEBUG [input] log/input.go:187 Start next scan
  458. авг 08 21:56:01 server1.local filebeat[10446]: 2019-08-08T21:56:01.357+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  459. авг 08 21:56:01 server1.local filebeat[10446]: 2019-08-08T21:56:01.357+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10025765
  460. авг 08 21:56:01 server1.local filebeat[10446]: 2019-08-08T21:56:01.357+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  461. авг 08 21:56:01 server1.local filebeat[10446]: 2019-08-08T21:56:01.357+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  462. авг 08 21:56:03 server1.local filebeat[10446]: 2019-08-08T21:56:03.355+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  463. авг 08 21:56:04 server1.local filebeat[10446]: 2019-08-08T21:56:04.357+0300 DEBUG [input] input/input.go:152 Run input
  464. авг 08 21:56:04 server1.local filebeat[10446]: 2019-08-08T21:56:04.357+0300 DEBUG [input] log/input.go:187 Start next scan
  465. авг 08 21:56:04 server1.local filebeat[10446]: 2019-08-08T21:56:04.357+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  466. авг 08 21:56:04 server1.local filebeat[10446]: 2019-08-08T21:56:04.357+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10025765
  467. авг 08 21:56:04 server1.local filebeat[10446]: 2019-08-08T21:56:04.357+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  468. авг 08 21:56:04 server1.local filebeat[10446]: 2019-08-08T21:56:04.357+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  469. авг 08 21:56:05 server1.local filebeat[10446]: 2019-08-08T21:56:05.354+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  470. авг 08 21:56:05 server1.local filebeat[10446]: 2019-08-08T21:56:05.355+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  471. авг 08 21:56:05 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:56:00.353Z",
  472. авг 08 21:56:05 server1.local filebeat[10446]: "@metadata": {
  473. авг 08 21:56:05 server1.local filebeat[10446]: "beat": "filebeat",
  474. авг 08 21:56:05 server1.local filebeat[10446]: "type": "_doc",
  475. авг 08 21:56:05 server1.local filebeat[10446]: "version": "7.2.0"
  476. авг 08 21:56:05 server1.local filebeat[10446]: },
  477. авг 08 21:56:05 server1.local filebeat[10446]: "shorthostname": "server1",
  478. авг 08 21:56:05 server1.local filebeat[10446]: "component": "app",
  479. авг 08 21:56:05 server1.local filebeat[10446]: "ecs": {
  480. авг 08 21:56:05 server1.local filebeat[10446]: "version": "1.0.0"
  481. авг 08 21:56:05 server1.local filebeat[10446]: },
  482. авг 08 21:56:05 server1.local filebeat[10446]: "log": {
  483. авг 08 21:56:05 server1.local filebeat[10446]: "flags": [
  484. авг 08 21:56:05 server1.local filebeat[10446]: "multiline"
  485. авг 08 21:56:05 server1.local filebeat[10446]: ],
  486. авг 08 21:56:05 server1.local filebeat[10446]: "offset": 10025765,
  487. авг 08 21:56:05 server1.local filebeat[10446]: "file": {
  488. авг 08 21:56:05 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  489. авг 08 21:56:05 server1.local filebeat[10446]: }
  490. авг 08 21:56:05 server1.local filebeat[10446]: },
  491. авг 08 21:56:05 server1.local filebeat[10446]: "message": "08-08-2019 21:56:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:00.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:00.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:00.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:00.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:00.005 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Starting scheduled archiveJob() - Thu Aug 08 21:56:00 GMT+03:00 2019\n08-08-2019 21:56:00.005 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Starting scheduled archiveJob() - Thu Aug 08 21:56:00 GMT+03:00 2019\n08-08-2019 21:56:00.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:00.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:00.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:00.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:00.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:00.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:00.009 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:00.009 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:00.019 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Scheduled archiving is disabled\n08-08-2019 21:56:00.019 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Scheduled archiving is disabled",
  492. авг 08 21:56:05 server1.local filebeat[10446]: "log_name": "auction",
  493. авг 08 21:56:05 server1.local filebeat[10446]: "host": {
  494. авг 08 21:56:05 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  495. авг 08 21:56:05 server1.local filebeat[10446]: "containerized": false,
  496. авг 08 21:56:05 server1.local filebeat[10446]: "hostname": "server1.local",
  497. авг 08 21:56:05 server1.local filebeat[10446]: "architecture": "x86_64",
  498. авг 08 21:56:05 server1.local filebeat[10446]: "os": {
  499. авг 08 21:56:05 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  500. авг 08 21:56:05 server1.local filebeat[10446]: "codename": "Maipo",
  501. авг 08 21:56:05 server1.local filebeat[10446]: "platform": "rhel",
  502. авг 08 21:56:05 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  503. авг 08 21:56:05 server1.local filebeat[10446]: "family": "redhat",
  504. авг 08 21:56:05 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server"
  505. авг 08 21:56:05 server1.local filebeat[10446]: },
  506. авг 08 21:56:05 server1.local filebeat[10446]: "name": "server1.local"
  507. авг 08 21:56:05 server1.local filebeat[10446]: },
  508. авг 08 21:56:05 server1.local filebeat[10446]: "agent": {
  509. авг 08 21:56:05 server1.local filebeat[10446]: "version": "7.2.0",
  510. авг 08 21:56:05 server1.local filebeat[10446]: "type": "filebeat",
  511. авг 08 21:56:05 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  512. авг 08 21:56:05 server1.local filebeat[10446]: "hostname": "server1.local",
  513. авг 08 21:56:05 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe"
  514. авг 08 21:56:05 server1.local filebeat[10446]: },
  515. авг 08 21:56:05 server1.local filebeat[10446]: "input": {
  516. авг 08 21:56:05 server1.local filebeat[10446]: "type": "log"
  517. авг 08 21:56:05 server1.local filebeat[10446]: },
  518. авг 08 21:56:05 server1.local filebeat[10446]: "system": "pgp",
  519. авг 08 21:56:05 server1.local filebeat[10446]: "env": "test"
  520. авг 08 21:56:05 server1.local filebeat[10446]: }
  521. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.357+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  522. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.358+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [3: 0, 1]
  523. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.358+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=4, end-seq=4
  524. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.358+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  525. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.358+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  526. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.358+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  527. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.358+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  528. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.358+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  529. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.359+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  530. авг 08 21:56:06 server1.local filebeat[10446]: 2019-08-08T21:56:06.363+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  531. авг 08 21:56:07 server1.local filebeat[10446]: 2019-08-08T21:56:07.355+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  532. авг 08 21:56:07 server1.local filebeat[10446]: 2019-08-08T21:56:07.358+0300 DEBUG [input] input/input.go:152 Run input
  533. авг 08 21:56:07 server1.local filebeat[10446]: 2019-08-08T21:56:07.358+0300 DEBUG [input] log/input.go:187 Start next scan
  534. авг 08 21:56:07 server1.local filebeat[10446]: 2019-08-08T21:56:07.358+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  535. авг 08 21:56:07 server1.local filebeat[10446]: 2019-08-08T21:56:07.358+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10028727
  536. авг 08 21:56:07 server1.local filebeat[10446]: 2019-08-08T21:56:07.358+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  537. авг 08 21:56:07 server1.local filebeat[10446]: 2019-08-08T21:56:07.358+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  538. авг 08 21:56:10 server1.local filebeat[10446]: 2019-08-08T21:56:10.358+0300 DEBUG [input] input/input.go:152 Run input
  539. авг 08 21:56:10 server1.local filebeat[10446]: 2019-08-08T21:56:10.358+0300 DEBUG [input] log/input.go:187 Start next scan
  540. авг 08 21:56:10 server1.local filebeat[10446]: 2019-08-08T21:56:10.358+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  541. авг 08 21:56:10 server1.local filebeat[10446]: 2019-08-08T21:56:10.358+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10028727
  542. авг 08 21:56:10 server1.local filebeat[10446]: 2019-08-08T21:56:10.358+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  543. авг 08 21:56:10 server1.local filebeat[10446]: 2019-08-08T21:56:10.358+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  544. авг 08 21:56:13 server1.local filebeat[10446]: 2019-08-08T21:56:13.359+0300 DEBUG [input] input/input.go:152 Run input
  545. авг 08 21:56:13 server1.local filebeat[10446]: 2019-08-08T21:56:13.359+0300 DEBUG [input] log/input.go:187 Start next scan
  546. авг 08 21:56:13 server1.local filebeat[10446]: 2019-08-08T21:56:13.359+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  547. авг 08 21:56:13 server1.local filebeat[10446]: 2019-08-08T21:56:13.359+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10028727
  548. авг 08 21:56:13 server1.local filebeat[10446]: 2019-08-08T21:56:13.359+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  549. авг 08 21:56:13 server1.local filebeat[10446]: 2019-08-08T21:56:13.359+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  550. авг 08 21:56:15 server1.local filebeat[10446]: 2019-08-08T21:56:15.356+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  551. авг 08 21:56:16 server1.local filebeat[10446]: 2019-08-08T21:56:16.356+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  552. авг 08 21:56:16 server1.local filebeat[10446]: 2019-08-08T21:56:16.359+0300 DEBUG [input] input/input.go:152 Run input
  553. авг 08 21:56:16 server1.local filebeat[10446]: 2019-08-08T21:56:16.359+0300 DEBUG [input] log/input.go:187 Start next scan
  554. авг 08 21:56:16 server1.local filebeat[10446]: 2019-08-08T21:56:16.359+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  555. авг 08 21:56:16 server1.local filebeat[10446]: 2019-08-08T21:56:16.359+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10028727
  556. авг 08 21:56:16 server1.local filebeat[10446]: 2019-08-08T21:56:16.359+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  557. авг 08 21:56:16 server1.local filebeat[10446]: 2019-08-08T21:56:16.359+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  558. авг 08 21:56:18 server1.local filebeat[10446]: 2019-08-08T21:56:18.357+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  559. авг 08 21:56:19 server1.local filebeat[10446]: 2019-08-08T21:56:19.360+0300 DEBUG [input] input/input.go:152 Run input
  560. авг 08 21:56:19 server1.local filebeat[10446]: 2019-08-08T21:56:19.360+0300 DEBUG [input] log/input.go:187 Start next scan
  561. авг 08 21:56:19 server1.local filebeat[10446]: 2019-08-08T21:56:19.360+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  562. авг 08 21:56:19 server1.local filebeat[10446]: 2019-08-08T21:56:19.360+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10028727
  563. авг 08 21:56:19 server1.local filebeat[10446]: 2019-08-08T21:56:19.360+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  564. авг 08 21:56:19 server1.local filebeat[10446]: 2019-08-08T21:56:19.360+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  565. авг 08 21:56:20 server1.local filebeat[10446]: 2019-08-08T21:56:20.356+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  566. авг 08 21:56:20 server1.local filebeat[10446]: 2019-08-08T21:56:20.357+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  567. авг 08 21:56:20 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:56:15.356Z",
  568. авг 08 21:56:20 server1.local filebeat[10446]: "@metadata": {
  569. авг 08 21:56:20 server1.local filebeat[10446]: "beat": "filebeat",
  570. авг 08 21:56:20 server1.local filebeat[10446]: "type": "_doc",
  571. авг 08 21:56:20 server1.local filebeat[10446]: "version": "7.2.0"
  572. авг 08 21:56:20 server1.local filebeat[10446]: },
  573. авг 08 21:56:20 server1.local filebeat[10446]: "log": {
  574. авг 08 21:56:20 server1.local filebeat[10446]: "flags": [
  575. авг 08 21:56:20 server1.local filebeat[10446]: "multiline"
  576. авг 08 21:56:20 server1.local filebeat[10446]: ],
  577. авг 08 21:56:20 server1.local filebeat[10446]: "offset": 10028727,
  578. авг 08 21:56:20 server1.local filebeat[10446]: "file": {
  579. авг 08 21:56:20 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  580. авг 08 21:56:20 server1.local filebeat[10446]: }
  581. авг 08 21:56:20 server1.local filebeat[10446]: },
  582. авг 08 21:56:20 server1.local filebeat[10446]: "shorthostname": "server1",
  583. авг 08 21:56:20 server1.local filebeat[10446]: "env": "test",
  584. авг 08 21:56:20 server1.local filebeat[10446]: "system": "pgp",
  585. авг 08 21:56:20 server1.local filebeat[10446]: "agent": {
  586. авг 08 21:56:20 server1.local filebeat[10446]: "version": "7.2.0",
  587. авг 08 21:56:20 server1.local filebeat[10446]: "type": "filebeat",
  588. авг 08 21:56:20 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  589. авг 08 21:56:20 server1.local filebeat[10446]: "hostname": "server1.local",
  590. авг 08 21:56:20 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe"
  591. авг 08 21:56:20 server1.local filebeat[10446]: },
  592. авг 08 21:56:20 server1.local filebeat[10446]: "host": {
  593. авг 08 21:56:20 server1.local filebeat[10446]: "name": "server1.local",
  594. авг 08 21:56:20 server1.local filebeat[10446]: "containerized": false,
  595. авг 08 21:56:20 server1.local filebeat[10446]: "hostname": "server1.local",
  596. авг 08 21:56:20 server1.local filebeat[10446]: "architecture": "x86_64",
  597. авг 08 21:56:20 server1.local filebeat[10446]: "os": {
  598. авг 08 21:56:20 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  599. авг 08 21:56:20 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  600. авг 08 21:56:20 server1.local filebeat[10446]: "codename": "Maipo",
  601. авг 08 21:56:20 server1.local filebeat[10446]: "platform": "rhel",
  602. авг 08 21:56:20 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  603. авг 08 21:56:20 server1.local filebeat[10446]: "family": "redhat"
  604. авг 08 21:56:20 server1.local filebeat[10446]: },
  605. авг 08 21:56:20 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41"
  606. авг 08 21:56:20 server1.local filebeat[10446]: },
  607. авг 08 21:56:20 server1.local filebeat[10446]: "message": "08-08-2019 21:56:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:10.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:10.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  608. авг 08 21:56:20 server1.local filebeat[10446]: "component": "app",
  609. авг 08 21:56:20 server1.local filebeat[10446]: "input": {
  610. авг 08 21:56:20 server1.local filebeat[10446]: "type": "log"
  611. авг 08 21:56:20 server1.local filebeat[10446]: },
  612. авг 08 21:56:20 server1.local filebeat[10446]: "log_name": "auction",
  613. авг 08 21:56:20 server1.local filebeat[10446]: "ecs": {
  614. авг 08 21:56:20 server1.local filebeat[10446]: "version": "1.0.0"
  615. авг 08 21:56:20 server1.local filebeat[10446]: }
  616. авг 08 21:56:20 server1.local filebeat[10446]: }
  617. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.359+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  618. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.359+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [4: 0, 1]
  619. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.359+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=5, end-seq=5
  620. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.359+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  621. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.359+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  622. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.359+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  623. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.360+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  624. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.360+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  625. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.360+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  626. авг 08 21:56:21 server1.local filebeat[10446]: 2019-08-08T21:56:21.364+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  627. авг 08 21:56:22 server1.local filebeat[10446]: 2019-08-08T21:56:22.357+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  628. авг 08 21:56:22 server1.local filebeat[10446]: 2019-08-08T21:56:22.360+0300 DEBUG [input] input/input.go:152 Run input
  629. авг 08 21:56:22 server1.local filebeat[10446]: 2019-08-08T21:56:22.360+0300 DEBUG [input] log/input.go:187 Start next scan
  630. авг 08 21:56:22 server1.local filebeat[10446]: 2019-08-08T21:56:22.360+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  631. авг 08 21:56:22 server1.local filebeat[10446]: 2019-08-08T21:56:22.360+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10029559
  632. авг 08 21:56:22 server1.local filebeat[10446]: 2019-08-08T21:56:22.360+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  633. авг 08 21:56:22 server1.local filebeat[10446]: 2019-08-08T21:56:22.360+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  634. авг 08 21:56:23 server1.local filebeat[10446]: 2019-08-08T21:56:23.358+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  635. авг 08 21:56:25 server1.local filebeat[10446]: 2019-08-08T21:56:25.358+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  636. авг 08 21:56:25 server1.local filebeat[10446]: 2019-08-08T21:56:25.361+0300 DEBUG [input] input/input.go:152 Run input
  637. авг 08 21:56:25 server1.local filebeat[10446]: 2019-08-08T21:56:25.361+0300 DEBUG [input] log/input.go:187 Start next scan
  638. авг 08 21:56:25 server1.local filebeat[10446]: 2019-08-08T21:56:25.361+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  639. авг 08 21:56:25 server1.local filebeat[10446]: 2019-08-08T21:56:25.361+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10029559
  640. авг 08 21:56:25 server1.local filebeat[10446]: 2019-08-08T21:56:25.361+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  641. авг 08 21:56:25 server1.local filebeat[10446]: 2019-08-08T21:56:25.361+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  642. авг 08 21:56:27 server1.local filebeat[10446]: 2019-08-08T21:56:27.358+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  643. авг 08 21:56:27 server1.local filebeat[10446]: 2019-08-08T21:56:27.358+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  644. авг 08 21:56:27 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:56:22.357Z",
  645. авг 08 21:56:27 server1.local filebeat[10446]: "@metadata": {
  646. авг 08 21:56:27 server1.local filebeat[10446]: "beat": "filebeat",
  647. авг 08 21:56:27 server1.local filebeat[10446]: "type": "_doc",
  648. авг 08 21:56:27 server1.local filebeat[10446]: "version": "7.2.0"
  649. авг 08 21:56:27 server1.local filebeat[10446]: },
  650. авг 08 21:56:27 server1.local filebeat[10446]: "message": "08-08-2019 21:56:20.005 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:20.005 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:20.005 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:20.005 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:20.005 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:20.005 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:20.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:20.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  651. авг 08 21:56:27 server1.local filebeat[10446]: "log_name": "auction",
  652. авг 08 21:56:27 server1.local filebeat[10446]: "env": "test",
  653. авг 08 21:56:27 server1.local filebeat[10446]: "input": {
  654. авг 08 21:56:27 server1.local filebeat[10446]: "type": "log"
  655. авг 08 21:56:27 server1.local filebeat[10446]: },
  656. авг 08 21:56:27 server1.local filebeat[10446]: "system": "pgp",
  657. авг 08 21:56:27 server1.local filebeat[10446]: "ecs": {
  658. авг 08 21:56:27 server1.local filebeat[10446]: "version": "1.0.0"
  659. авг 08 21:56:27 server1.local filebeat[10446]: },
  660. авг 08 21:56:27 server1.local filebeat[10446]: "host": {
  661. авг 08 21:56:27 server1.local filebeat[10446]: "hostname": "server1.local",
  662. авг 08 21:56:27 server1.local filebeat[10446]: "architecture": "x86_64",
  663. авг 08 21:56:27 server1.local filebeat[10446]: "os": {
  664. авг 08 21:56:27 server1.local filebeat[10446]: "family": "redhat",
  665. авг 08 21:56:27 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  666. авг 08 21:56:27 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  667. авг 08 21:56:27 server1.local filebeat[10446]: "codename": "Maipo",
  668. авг 08 21:56:27 server1.local filebeat[10446]: "platform": "rhel",
  669. авг 08 21:56:27 server1.local filebeat[10446]: "version": "7.4 (Maipo)"
  670. авг 08 21:56:27 server1.local filebeat[10446]: },
  671. авг 08 21:56:27 server1.local filebeat[10446]: "name": "server1.local",
  672. авг 08 21:56:27 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  673. авг 08 21:56:27 server1.local filebeat[10446]: "containerized": false
  674. авг 08 21:56:27 server1.local filebeat[10446]: },
  675. авг 08 21:56:27 server1.local filebeat[10446]: "log": {
  676. авг 08 21:56:27 server1.local filebeat[10446]: "file": {
  677. авг 08 21:56:27 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  678. авг 08 21:56:27 server1.local filebeat[10446]: },
  679. авг 08 21:56:27 server1.local filebeat[10446]: "flags": [
  680. авг 08 21:56:27 server1.local filebeat[10446]: "multiline"
  681. авг 08 21:56:27 server1.local filebeat[10446]: ],
  682. авг 08 21:56:27 server1.local filebeat[10446]: "offset": 10029559
  683. авг 08 21:56:27 server1.local filebeat[10446]: },
  684. авг 08 21:56:27 server1.local filebeat[10446]: "shorthostname": "server1",
  685. авг 08 21:56:27 server1.local filebeat[10446]: "component": "app",
  686. авг 08 21:56:27 server1.local filebeat[10446]: "agent": {
  687. авг 08 21:56:27 server1.local filebeat[10446]: "type": "filebeat",
  688. авг 08 21:56:27 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  689. авг 08 21:56:27 server1.local filebeat[10446]: "hostname": "server1.local",
  690. авг 08 21:56:27 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  691. авг 08 21:56:27 server1.local filebeat[10446]: "version": "7.2.0"
  692. авг 08 21:56:27 server1.local filebeat[10446]: }
  693. авг 08 21:56:27 server1.local filebeat[10446]: }
  694. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.341+0300 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":90,"time":{"ms":10}},"total":{"ticks":230,"time":{"ms":43},"value":230},"user":{"ticks":140,"time":{"ms":33}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":7},"info":{"ephemeral_id":"ff21c997-2f19-4d77-ac3d-a9757df39597","uptime":{"ms":60054}},"memstats":{"gc_next":6721616,"memory_alloc":3448704,"memory_total":15066624},"runtime":{"goroutines":26}},"filebeat":{"events":{"active":1,"added":4,"done":3},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":3,"batches":3,"total":3},"read":{"bytes":18},"write":{"bytes":2579}},"pipeline":{"clients":1,"events":{"active":1,"published":4,"total":4},"queue":{"acked":3}}},"registrar":{"states":{"current":5,"update":3},"writes":{"success":3,"total":3}},"system":{"load":{"1":0.19,"15":0.16,"5":0.2,"norm":{"1":0.0475,"15":0.04,"5":0.05}}}}}}
  695. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.360+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  696. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [5: 0, 1]
  697. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=6, end-seq=6
  698. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  699. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  700. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  701. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  702. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  703. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  704. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [input] input/input.go:152 Run input
  705. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.361+0300 DEBUG [input] log/input.go:187 Start next scan
  706. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.362+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  707. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.362+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10030391
  708. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.362+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  709. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.362+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  710. авг 08 21:56:28 server1.local filebeat[10446]: 2019-08-08T21:56:28.365+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  711. авг 08 21:56:29 server1.local filebeat[10446]: 2019-08-08T21:56:29.359+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  712. авг 08 21:56:31 server1.local filebeat[10446]: 2019-08-08T21:56:31.362+0300 DEBUG [input] input/input.go:152 Run input
  713. авг 08 21:56:31 server1.local filebeat[10446]: 2019-08-08T21:56:31.362+0300 DEBUG [input] log/input.go:187 Start next scan
  714. авг 08 21:56:31 server1.local filebeat[10446]: 2019-08-08T21:56:31.362+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  715. авг 08 21:56:31 server1.local filebeat[10446]: 2019-08-08T21:56:31.362+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10030391
  716. авг 08 21:56:31 server1.local filebeat[10446]: 2019-08-08T21:56:31.362+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  717. авг 08 21:56:31 server1.local filebeat[10446]: 2019-08-08T21:56:31.362+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  718. авг 08 21:56:34 server1.local filebeat[10446]: 2019-08-08T21:56:34.362+0300 DEBUG [input] input/input.go:152 Run input
  719. авг 08 21:56:34 server1.local filebeat[10446]: 2019-08-08T21:56:34.363+0300 DEBUG [input] log/input.go:187 Start next scan
  720. авг 08 21:56:34 server1.local filebeat[10446]: 2019-08-08T21:56:34.363+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  721. авг 08 21:56:34 server1.local filebeat[10446]: 2019-08-08T21:56:34.363+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10030391
  722. авг 08 21:56:34 server1.local filebeat[10446]: 2019-08-08T21:56:34.363+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  723. авг 08 21:56:34 server1.local filebeat[10446]: 2019-08-08T21:56:34.363+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  724. авг 08 21:56:37 server1.local filebeat[10446]: 2019-08-08T21:56:37.359+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  725. авг 08 21:56:37 server1.local filebeat[10446]: 2019-08-08T21:56:37.363+0300 DEBUG [input] input/input.go:152 Run input
  726. авг 08 21:56:37 server1.local filebeat[10446]: 2019-08-08T21:56:37.363+0300 DEBUG [input] log/input.go:187 Start next scan
  727. авг 08 21:56:37 server1.local filebeat[10446]: 2019-08-08T21:56:37.363+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  728. авг 08 21:56:37 server1.local filebeat[10446]: 2019-08-08T21:56:37.363+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10030391
  729. авг 08 21:56:37 server1.local filebeat[10446]: 2019-08-08T21:56:37.363+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  730. авг 08 21:56:37 server1.local filebeat[10446]: 2019-08-08T21:56:37.363+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  731. авг 08 21:56:38 server1.local filebeat[10446]: 2019-08-08T21:56:38.360+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  732. авг 08 21:56:40 server1.local filebeat[10446]: 2019-08-08T21:56:40.360+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  733. авг 08 21:56:40 server1.local filebeat[10446]: 2019-08-08T21:56:40.365+0300 DEBUG [input] input/input.go:152 Run input
  734. авг 08 21:56:40 server1.local filebeat[10446]: 2019-08-08T21:56:40.365+0300 DEBUG [input] log/input.go:187 Start next scan
  735. авг 08 21:56:40 server1.local filebeat[10446]: 2019-08-08T21:56:40.365+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  736. авг 08 21:56:40 server1.local filebeat[10446]: 2019-08-08T21:56:40.365+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10030391
  737. авг 08 21:56:40 server1.local filebeat[10446]: 2019-08-08T21:56:40.365+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  738. авг 08 21:56:40 server1.local filebeat[10446]: 2019-08-08T21:56:40.365+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  739. авг 08 21:56:41 server1.local filebeat[10446]: 2019-08-08T21:56:41.361+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  740. авг 08 21:56:43 server1.local filebeat[10446]: 2019-08-08T21:56:43.361+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  741. авг 08 21:56:43 server1.local filebeat[10446]: 2019-08-08T21:56:43.365+0300 DEBUG [input] input/input.go:152 Run input
  742. авг 08 21:56:43 server1.local filebeat[10446]: 2019-08-08T21:56:43.365+0300 DEBUG [input] log/input.go:187 Start next scan
  743. авг 08 21:56:43 server1.local filebeat[10446]: 2019-08-08T21:56:43.365+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  744. авг 08 21:56:43 server1.local filebeat[10446]: 2019-08-08T21:56:43.365+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10030391
  745. авг 08 21:56:43 server1.local filebeat[10446]: 2019-08-08T21:56:43.365+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  746. авг 08 21:56:43 server1.local filebeat[10446]: 2019-08-08T21:56:43.365+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  747. авг 08 21:56:44 server1.local filebeat[10446]: 2019-08-08T21:56:44.361+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  748. авг 08 21:56:46 server1.local filebeat[10446]: 2019-08-08T21:56:46.362+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  749. авг 08 21:56:46 server1.local filebeat[10446]: 2019-08-08T21:56:46.366+0300 DEBUG [input] input/input.go:152 Run input
  750. авг 08 21:56:46 server1.local filebeat[10446]: 2019-08-08T21:56:46.366+0300 DEBUG [input] log/input.go:187 Start next scan
  751. авг 08 21:56:46 server1.local filebeat[10446]: 2019-08-08T21:56:46.366+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  752. авг 08 21:56:46 server1.local filebeat[10446]: 2019-08-08T21:56:46.366+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10030391
  753. авг 08 21:56:46 server1.local filebeat[10446]: 2019-08-08T21:56:46.366+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  754. авг 08 21:56:46 server1.local filebeat[10446]: 2019-08-08T21:56:46.366+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  755. авг 08 21:56:48 server1.local filebeat[10446]: 2019-08-08T21:56:48.361+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  756. авг 08 21:56:48 server1.local filebeat[10446]: 2019-08-08T21:56:48.362+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  757. авг 08 21:56:48 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:56:37.359Z",
  758. авг 08 21:56:48 server1.local filebeat[10446]: "@metadata": {
  759. авг 08 21:56:48 server1.local filebeat[10446]: "beat": "filebeat",
  760. авг 08 21:56:48 server1.local filebeat[10446]: "type": "_doc",
  761. авг 08 21:56:48 server1.local filebeat[10446]: "version": "7.2.0"
  762. авг 08 21:56:48 server1.local filebeat[10446]: },
  763. авг 08 21:56:48 server1.local filebeat[10446]: "component": "app",
  764. авг 08 21:56:48 server1.local filebeat[10446]: "message": "08-08-2019 21:56:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:30.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:30.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:40.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:40.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:40.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:40.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:40.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:40.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:40.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:40.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:41.960 TRACE r.f.t.a.service.impl.IndexQueueImpl - Index queue is empty\n08-08-2019 21:56:41.960 TRACE r.f.t.a.service.impl.IndexQueueImpl - Index queue is empty",
  765. авг 08 21:56:48 server1.local filebeat[10446]: "system": "pgp",
  766. авг 08 21:56:48 server1.local filebeat[10446]: "log_name": "auction",
  767. авг 08 21:56:48 server1.local filebeat[10446]: "shorthostname": "server1",
  768. авг 08 21:56:48 server1.local filebeat[10446]: "host": {
  769. авг 08 21:56:48 server1.local filebeat[10446]: "name": "server1.local",
  770. авг 08 21:56:48 server1.local filebeat[10446]: "architecture": "x86_64",
  771. авг 08 21:56:48 server1.local filebeat[10446]: "os": {
  772. авг 08 21:56:48 server1.local filebeat[10446]: "family": "redhat",
  773. авг 08 21:56:48 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  774. авг 08 21:56:48 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  775. авг 08 21:56:48 server1.local filebeat[10446]: "codename": "Maipo",
  776. авг 08 21:56:48 server1.local filebeat[10446]: "platform": "rhel",
  777. авг 08 21:56:48 server1.local filebeat[10446]: "version": "7.4 (Maipo)"
  778. авг 08 21:56:48 server1.local filebeat[10446]: },
  779. авг 08 21:56:48 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  780. авг 08 21:56:48 server1.local filebeat[10446]: "containerized": false,
  781. авг 08 21:56:48 server1.local filebeat[10446]: "hostname": "server1.local"
  782. авг 08 21:56:48 server1.local filebeat[10446]: },
  783. авг 08 21:56:48 server1.local filebeat[10446]: "agent": {
  784. авг 08 21:56:48 server1.local filebeat[10446]: "version": "7.2.0",
  785. авг 08 21:56:48 server1.local filebeat[10446]: "type": "filebeat",
  786. авг 08 21:56:48 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  787. авг 08 21:56:48 server1.local filebeat[10446]: "hostname": "server1.local",
  788. авг 08 21:56:48 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe"
  789. авг 08 21:56:48 server1.local filebeat[10446]: },
  790. авг 08 21:56:48 server1.local filebeat[10446]: "log": {
  791. авг 08 21:56:48 server1.local filebeat[10446]: "flags": [
  792. авг 08 21:56:48 server1.local filebeat[10446]: "multiline"
  793. авг 08 21:56:48 server1.local filebeat[10446]: ],
  794. авг 08 21:56:48 server1.local filebeat[10446]: "offset": 10030391,
  795. авг 08 21:56:48 server1.local filebeat[10446]: "file": {
  796. авг 08 21:56:48 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  797. авг 08 21:56:48 server1.local filebeat[10446]: }
  798. авг 08 21:56:48 server1.local filebeat[10446]: },
  799. авг 08 21:56:48 server1.local filebeat[10446]: "input": {
  800. авг 08 21:56:48 server1.local filebeat[10446]: "type": "log"
  801. авг 08 21:56:48 server1.local filebeat[10446]: },
  802. авг 08 21:56:48 server1.local filebeat[10446]: "env": "test",
  803. авг 08 21:56:48 server1.local filebeat[10446]: "ecs": {
  804. авг 08 21:56:48 server1.local filebeat[10446]: "version": "1.0.0"
  805. авг 08 21:56:48 server1.local filebeat[10446]: }
  806. авг 08 21:56:48 server1.local filebeat[10446]: }
  807. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.363+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  808. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [6: 0, 1]
  809. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=7, end-seq=7
  810. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  811. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  812. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  813. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  814. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  815. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.364+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  816. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.366+0300 DEBUG [input] input/input.go:152 Run input
  817. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.366+0300 DEBUG [input] log/input.go:187 Start next scan
  818. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.366+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  819. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.366+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10032233
  820. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.366+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  821. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.366+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  822. авг 08 21:56:49 server1.local filebeat[10446]: 2019-08-08T21:56:49.373+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  823. авг 08 21:56:50 server1.local filebeat[10446]: 2019-08-08T21:56:50.362+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  824. авг 08 21:56:51 server1.local filebeat[10446]: 2019-08-08T21:56:51.363+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  825. авг 08 21:56:52 server1.local filebeat[10446]: 2019-08-08T21:56:52.366+0300 DEBUG [input] input/input.go:152 Run input
  826. авг 08 21:56:52 server1.local filebeat[10446]: 2019-08-08T21:56:52.367+0300 DEBUG [input] log/input.go:187 Start next scan
  827. авг 08 21:56:52 server1.local filebeat[10446]: 2019-08-08T21:56:52.367+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  828. авг 08 21:56:52 server1.local filebeat[10446]: 2019-08-08T21:56:52.367+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10032233
  829. авг 08 21:56:52 server1.local filebeat[10446]: 2019-08-08T21:56:52.367+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  830. авг 08 21:56:52 server1.local filebeat[10446]: 2019-08-08T21:56:52.367+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  831. авг 08 21:56:53 server1.local filebeat[10446]: 2019-08-08T21:56:53.363+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  832. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.363+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  833. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.363+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  834. авг 08 21:56:55 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:56:50.362Z",
  835. авг 08 21:56:55 server1.local filebeat[10446]: "@metadata": {
  836. авг 08 21:56:55 server1.local filebeat[10446]: "beat": "filebeat",
  837. авг 08 21:56:55 server1.local filebeat[10446]: "type": "_doc",
  838. авг 08 21:56:55 server1.local filebeat[10446]: "version": "7.2.0"
  839. авг 08 21:56:55 server1.local filebeat[10446]: },
  840. авг 08 21:56:55 server1.local filebeat[10446]: "component": "app",
  841. авг 08 21:56:55 server1.local filebeat[10446]: "agent": {
  842. авг 08 21:56:55 server1.local filebeat[10446]: "hostname": "server1.local",
  843. авг 08 21:56:55 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  844. авг 08 21:56:55 server1.local filebeat[10446]: "version": "7.2.0",
  845. авг 08 21:56:55 server1.local filebeat[10446]: "type": "filebeat",
  846. авг 08 21:56:55 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597"
  847. авг 08 21:56:55 server1.local filebeat[10446]: },
  848. авг 08 21:56:55 server1.local filebeat[10446]: "host": {
  849. авг 08 21:56:55 server1.local filebeat[10446]: "containerized": false,
  850. авг 08 21:56:55 server1.local filebeat[10446]: "hostname": "server1.local",
  851. авг 08 21:56:55 server1.local filebeat[10446]: "architecture": "x86_64",
  852. авг 08 21:56:55 server1.local filebeat[10446]: "os": {
  853. авг 08 21:56:55 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  854. авг 08 21:56:55 server1.local filebeat[10446]: "codename": "Maipo",
  855. авг 08 21:56:55 server1.local filebeat[10446]: "platform": "rhel",
  856. авг 08 21:56:55 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  857. авг 08 21:56:55 server1.local filebeat[10446]: "family": "redhat",
  858. авг 08 21:56:55 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server"
  859. авг 08 21:56:55 server1.local filebeat[10446]: },
  860. авг 08 21:56:55 server1.local filebeat[10446]: "name": "server1.local",
  861. авг 08 21:56:55 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41"
  862. авг 08 21:56:55 server1.local filebeat[10446]: },
  863. авг 08 21:56:55 server1.local filebeat[10446]: "log": {
  864. авг 08 21:56:55 server1.local filebeat[10446]: "offset": 10032233,
  865. авг 08 21:56:55 server1.local filebeat[10446]: "file": {
  866. авг 08 21:56:55 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  867. авг 08 21:56:55 server1.local filebeat[10446]: },
  868. авг 08 21:56:55 server1.local filebeat[10446]: "flags": [
  869. авг 08 21:56:55 server1.local filebeat[10446]: "multiline"
  870. авг 08 21:56:55 server1.local filebeat[10446]: ]
  871. авг 08 21:56:55 server1.local filebeat[10446]: },
  872. авг 08 21:56:55 server1.local filebeat[10446]: "env": "test",
  873. авг 08 21:56:55 server1.local filebeat[10446]: "log_name": "auction",
  874. авг 08 21:56:55 server1.local filebeat[10446]: "shorthostname": "server1",
  875. авг 08 21:56:55 server1.local filebeat[10446]: "message": "08-08-2019 21:56:50.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:50.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:56:50.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:50.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:56:50.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:50.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:56:50.015 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:56:50.015 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  876. авг 08 21:56:55 server1.local filebeat[10446]: "input": {
  877. авг 08 21:56:55 server1.local filebeat[10446]: "type": "log"
  878. авг 08 21:56:55 server1.local filebeat[10446]: },
  879. авг 08 21:56:55 server1.local filebeat[10446]: "system": "pgp",
  880. авг 08 21:56:55 server1.local filebeat[10446]: "ecs": {
  881. авг 08 21:56:55 server1.local filebeat[10446]: "version": "1.0.0"
  882. авг 08 21:56:55 server1.local filebeat[10446]: }
  883. авг 08 21:56:55 server1.local filebeat[10446]: }
  884. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.367+0300 DEBUG [input] input/input.go:152 Run input
  885. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.367+0300 DEBUG [input] log/input.go:187 Start next scan
  886. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.367+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  887. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.367+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10033065
  888. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.367+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  889. авг 08 21:56:55 server1.local filebeat[10446]: 2019-08-08T21:56:55.367+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  890. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.365+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  891. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [7: 0, 1]
  892. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=8, end-seq=8
  893. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  894. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  895. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  896. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  897. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  898. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.366+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  899. авг 08 21:56:56 server1.local filebeat[10446]: 2019-08-08T21:56:56.371+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  900. авг 08 21:56:57 server1.local filebeat[10446]: 2019-08-08T21:56:57.364+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  901. авг 08 21:56:58 server1.local filebeat[10446]: 2019-08-08T21:56:58.341+0300 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":100,"time":{"ms":17}},"total":{"ticks":260,"time":{"ms":41},"value":260},"user":{"ticks":160,"time":{"ms":24}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":7},"info":{"ephemeral_id":"ff21c997-2f19-4d77-ac3d-a9757df39597","uptime":{"ms":90055}},"memstats":{"gc_next":6709632,"memory_alloc":3465240,"memory_total":20271224},"runtime":{"goroutines":26}},"filebeat":{"events":{"active":-1,"added":2,"done":3},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":3,"batches":3,"total":3},"read":{"bytes":18},"write":{"bytes":2360}},"pipeline":{"clients":1,"events":{"active":0,"published":2,"total":2},"queue":{"acked":3}}},"registrar":{"states":{"current":5,"update":3},"writes":{"success":3,"total":3}},"system":{"load":{"1":0.11,"15":0.16,"5":0.18,"norm":{"1":0.0275,"15":0.04,"5":0.045}}}}}}
  902. авг 08 21:56:58 server1.local filebeat[10446]: 2019-08-08T21:56:58.367+0300 DEBUG [input] input/input.go:152 Run input
  903. авг 08 21:56:58 server1.local filebeat[10446]: 2019-08-08T21:56:58.368+0300 DEBUG [input] log/input.go:187 Start next scan
  904. авг 08 21:56:58 server1.local filebeat[10446]: 2019-08-08T21:56:58.368+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  905. авг 08 21:56:58 server1.local filebeat[10446]: 2019-08-08T21:56:58.368+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10033065
  906. авг 08 21:56:58 server1.local filebeat[10446]: 2019-08-08T21:56:58.368+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  907. авг 08 21:56:58 server1.local filebeat[10446]: 2019-08-08T21:56:58.368+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  908. авг 08 21:57:01 server1.local filebeat[10446]: 2019-08-08T21:57:01.368+0300 DEBUG [input] input/input.go:152 Run input
  909. авг 08 21:57:01 server1.local filebeat[10446]: 2019-08-08T21:57:01.368+0300 DEBUG [input] log/input.go:187 Start next scan
  910. авг 08 21:57:01 server1.local filebeat[10446]: 2019-08-08T21:57:01.368+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  911. авг 08 21:57:01 server1.local filebeat[10446]: 2019-08-08T21:57:01.368+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10033065
  912. авг 08 21:57:01 server1.local filebeat[10446]: 2019-08-08T21:57:01.368+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  913. авг 08 21:57:01 server1.local filebeat[10446]: 2019-08-08T21:57:01.368+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  914. авг 08 21:57:04 server1.local filebeat[10446]: 2019-08-08T21:57:04.369+0300 DEBUG [input] input/input.go:152 Run input
  915. авг 08 21:57:04 server1.local filebeat[10446]: 2019-08-08T21:57:04.369+0300 DEBUG [input] log/input.go:187 Start next scan
  916. авг 08 21:57:04 server1.local filebeat[10446]: 2019-08-08T21:57:04.369+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  917. авг 08 21:57:04 server1.local filebeat[10446]: 2019-08-08T21:57:04.369+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10033065
  918. авг 08 21:57:04 server1.local filebeat[10446]: 2019-08-08T21:57:04.369+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  919. авг 08 21:57:04 server1.local filebeat[10446]: 2019-08-08T21:57:04.369+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  920. авг 08 21:57:05 server1.local filebeat[10446]: 2019-08-08T21:57:05.364+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  921. авг 08 21:57:06 server1.local filebeat[10446]: 2019-08-08T21:57:06.365+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  922. авг 08 21:57:07 server1.local filebeat[10446]: 2019-08-08T21:57:07.369+0300 DEBUG [input] input/input.go:152 Run input
  923. авг 08 21:57:07 server1.local filebeat[10446]: 2019-08-08T21:57:07.369+0300 DEBUG [input] log/input.go:187 Start next scan
  924. авг 08 21:57:07 server1.local filebeat[10446]: 2019-08-08T21:57:07.369+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  925. авг 08 21:57:07 server1.local filebeat[10446]: 2019-08-08T21:57:07.370+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10033065
  926. авг 08 21:57:07 server1.local filebeat[10446]: 2019-08-08T21:57:07.370+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  927. авг 08 21:57:07 server1.local filebeat[10446]: 2019-08-08T21:57:07.370+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  928. авг 08 21:57:08 server1.local filebeat[10446]: 2019-08-08T21:57:08.365+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  929. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.364+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  930. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.365+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  931. авг 08 21:57:10 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:57:05.364Z",
  932. авг 08 21:57:10 server1.local filebeat[10446]: "@metadata": {
  933. авг 08 21:57:10 server1.local filebeat[10446]: "beat": "filebeat",
  934. авг 08 21:57:10 server1.local filebeat[10446]: "type": "_doc",
  935. авг 08 21:57:10 server1.local filebeat[10446]: "version": "7.2.0"
  936. авг 08 21:57:10 server1.local filebeat[10446]: },
  937. авг 08 21:57:10 server1.local filebeat[10446]: "log_name": "auction",
  938. авг 08 21:57:10 server1.local filebeat[10446]: "shorthostname": "server1",
  939. авг 08 21:57:10 server1.local filebeat[10446]: "env": "test",
  940. авг 08 21:57:10 server1.local filebeat[10446]: "component": "app",
  941. авг 08 21:57:10 server1.local filebeat[10446]: "host": {
  942. авг 08 21:57:10 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  943. авг 08 21:57:10 server1.local filebeat[10446]: "containerized": false,
  944. авг 08 21:57:10 server1.local filebeat[10446]: "name": "server1.local",
  945. авг 08 21:57:10 server1.local filebeat[10446]: "hostname": "server1.local",
  946. авг 08 21:57:10 server1.local filebeat[10446]: "architecture": "x86_64",
  947. авг 08 21:57:10 server1.local filebeat[10446]: "os": {
  948. авг 08 21:57:10 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  949. авг 08 21:57:10 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  950. авг 08 21:57:10 server1.local filebeat[10446]: "codename": "Maipo",
  951. авг 08 21:57:10 server1.local filebeat[10446]: "platform": "rhel",
  952. авг 08 21:57:10 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  953. авг 08 21:57:10 server1.local filebeat[10446]: "family": "redhat"
  954. авг 08 21:57:10 server1.local filebeat[10446]: }
  955. авг 08 21:57:10 server1.local filebeat[10446]: },
  956. авг 08 21:57:10 server1.local filebeat[10446]: "agent": {
  957. авг 08 21:57:10 server1.local filebeat[10446]: "type": "filebeat",
  958. авг 08 21:57:10 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  959. авг 08 21:57:10 server1.local filebeat[10446]: "hostname": "server1.local",
  960. авг 08 21:57:10 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  961. авг 08 21:57:10 server1.local filebeat[10446]: "version": "7.2.0"
  962. авг 08 21:57:10 server1.local filebeat[10446]: },
  963. авг 08 21:57:10 server1.local filebeat[10446]: "ecs": {
  964. авг 08 21:57:10 server1.local filebeat[10446]: "version": "1.0.0"
  965. авг 08 21:57:10 server1.local filebeat[10446]: },
  966. авг 08 21:57:10 server1.local filebeat[10446]: "log": {
  967. авг 08 21:57:10 server1.local filebeat[10446]: "file": {
  968. авг 08 21:57:10 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  969. авг 08 21:57:10 server1.local filebeat[10446]: },
  970. авг 08 21:57:10 server1.local filebeat[10446]: "flags": [
  971. авг 08 21:57:10 server1.local filebeat[10446]: "multiline"
  972. авг 08 21:57:10 server1.local filebeat[10446]: ],
  973. авг 08 21:57:10 server1.local filebeat[10446]: "offset": 10033065
  974. авг 08 21:57:10 server1.local filebeat[10446]: },
  975. авг 08 21:57:10 server1.local filebeat[10446]: "message": "08-08-2019 21:57:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:00.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:00.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:00.007 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:00.007 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:00.008 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Starting scheduled archiveJob() - Thu Aug 08 21:57:00 GMT+03:00 2019\n08-08-2019 21:57:00.008 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Starting scheduled archiveJob() - Thu Aug 08 21:57:00 GMT+03:00 2019\n08-08-2019 21:57:00.008 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:00.008 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:00.008 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:00.008 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:00.009 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:00.009 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:00.016 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:00.016 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:00.019 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Scheduled archiving is disabled\n08-08-2019 21:57:00.019 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Scheduled archiving is disabled",
  976. авг 08 21:57:10 server1.local filebeat[10446]: "input": {
  977. авг 08 21:57:10 server1.local filebeat[10446]: "type": "log"
  978. авг 08 21:57:10 server1.local filebeat[10446]: },
  979. авг 08 21:57:10 server1.local filebeat[10446]: "system": "pgp"
  980. авг 08 21:57:10 server1.local filebeat[10446]: }
  981. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.370+0300 DEBUG [input] input/input.go:152 Run input
  982. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.370+0300 DEBUG [input] log/input.go:187 Start next scan
  983. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.370+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  984. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.370+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036027
  985. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.370+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  986. авг 08 21:57:10 server1.local filebeat[10446]: 2019-08-08T21:57:10.370+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  987. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.366+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  988. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.367+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [8: 0, 1]
  989. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.367+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=9, end-seq=9
  990. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.367+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  991. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.367+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  992. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.368+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  993. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.368+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  994. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.368+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  995. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.368+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  996. авг 08 21:57:11 server1.local filebeat[10446]: 2019-08-08T21:57:11.372+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  997. авг 08 21:57:12 server1.local filebeat[10446]: 2019-08-08T21:57:12.366+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  998. авг 08 21:57:13 server1.local filebeat[10446]: 2019-08-08T21:57:13.366+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  999. авг 08 21:57:13 server1.local filebeat[10446]: 2019-08-08T21:57:13.370+0300 DEBUG [input] input/input.go:152 Run input
  1000. авг 08 21:57:13 server1.local filebeat[10446]: 2019-08-08T21:57:13.370+0300 DEBUG [input] log/input.go:187 Start next scan
  1001. авг 08 21:57:13 server1.local filebeat[10446]: 2019-08-08T21:57:13.371+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1002. авг 08 21:57:13 server1.local filebeat[10446]: 2019-08-08T21:57:13.371+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036027
  1003. авг 08 21:57:13 server1.local filebeat[10446]: 2019-08-08T21:57:13.371+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1004. авг 08 21:57:13 server1.local filebeat[10446]: 2019-08-08T21:57:13.371+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1005. авг 08 21:57:15 server1.local filebeat[10446]: 2019-08-08T21:57:15.367+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1006. авг 08 21:57:16 server1.local filebeat[10446]: 2019-08-08T21:57:16.371+0300 DEBUG [input] input/input.go:152 Run input
  1007. авг 08 21:57:16 server1.local filebeat[10446]: 2019-08-08T21:57:16.371+0300 DEBUG [input] log/input.go:187 Start next scan
  1008. авг 08 21:57:16 server1.local filebeat[10446]: 2019-08-08T21:57:16.371+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1009. авг 08 21:57:16 server1.local filebeat[10446]: 2019-08-08T21:57:16.371+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036027
  1010. авг 08 21:57:16 server1.local filebeat[10446]: 2019-08-08T21:57:16.371+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1011. авг 08 21:57:16 server1.local filebeat[10446]: 2019-08-08T21:57:16.371+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1012. авг 08 21:57:17 server1.local filebeat[10446]: 2019-08-08T21:57:17.366+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  1013. авг 08 21:57:17 server1.local filebeat[10446]: 2019-08-08T21:57:17.366+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  1014. авг 08 21:57:17 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:57:12.365Z",
  1015. авг 08 21:57:17 server1.local filebeat[10446]: "@metadata": {
  1016. авг 08 21:57:17 server1.local filebeat[10446]: "beat": "filebeat",
  1017. авг 08 21:57:17 server1.local filebeat[10446]: "type": "_doc",
  1018. авг 08 21:57:17 server1.local filebeat[10446]: "version": "7.2.0"
  1019. авг 08 21:57:17 server1.local filebeat[10446]: },
  1020. авг 08 21:57:17 server1.local filebeat[10446]: "log": {
  1021. авг 08 21:57:17 server1.local filebeat[10446]: "offset": 10036027,
  1022. авг 08 21:57:17 server1.local filebeat[10446]: "file": {
  1023. авг 08 21:57:17 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  1024. авг 08 21:57:17 server1.local filebeat[10446]: },
  1025. авг 08 21:57:17 server1.local filebeat[10446]: "flags": [
  1026. авг 08 21:57:17 server1.local filebeat[10446]: "multiline"
  1027. авг 08 21:57:17 server1.local filebeat[10446]: ]
  1028. авг 08 21:57:17 server1.local filebeat[10446]: },
  1029. авг 08 21:57:17 server1.local filebeat[10446]: "input": {
  1030. авг 08 21:57:17 server1.local filebeat[10446]: "type": "log"
  1031. авг 08 21:57:17 server1.local filebeat[10446]: },
  1032. авг 08 21:57:17 server1.local filebeat[10446]: "log_name": "auction",
  1033. авг 08 21:57:17 server1.local filebeat[10446]: "shorthostname": "server1",
  1034. авг 08 21:57:17 server1.local filebeat[10446]: "env": "test",
  1035. авг 08 21:57:17 server1.local filebeat[10446]: "ecs": {
  1036. авг 08 21:57:17 server1.local filebeat[10446]: "version": "1.0.0"
  1037. авг 08 21:57:17 server1.local filebeat[10446]: },
  1038. авг 08 21:57:17 server1.local filebeat[10446]: "host": {
  1039. авг 08 21:57:17 server1.local filebeat[10446]: "name": "server1.local",
  1040. авг 08 21:57:17 server1.local filebeat[10446]: "hostname": "server1.local",
  1041. авг 08 21:57:17 server1.local filebeat[10446]: "architecture": "x86_64",
  1042. авг 08 21:57:17 server1.local filebeat[10446]: "os": {
  1043. авг 08 21:57:17 server1.local filebeat[10446]: "platform": "rhel",
  1044. авг 08 21:57:17 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  1045. авг 08 21:57:17 server1.local filebeat[10446]: "family": "redhat",
  1046. авг 08 21:57:17 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  1047. авг 08 21:57:17 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  1048. авг 08 21:57:17 server1.local filebeat[10446]: "codename": "Maipo"
  1049. авг 08 21:57:17 server1.local filebeat[10446]: },
  1050. авг 08 21:57:17 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  1051. авг 08 21:57:17 server1.local filebeat[10446]: "containerized": false
  1052. авг 08 21:57:17 server1.local filebeat[10446]: },
  1053. авг 08 21:57:17 server1.local filebeat[10446]: "message": "08-08-2019 21:57:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:10.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:10.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  1054. авг 08 21:57:17 server1.local filebeat[10446]: "system": "pgp",
  1055. авг 08 21:57:17 server1.local filebeat[10446]: "component": "app",
  1056. авг 08 21:57:17 server1.local filebeat[10446]: "agent": {
  1057. авг 08 21:57:17 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  1058. авг 08 21:57:17 server1.local filebeat[10446]: "hostname": "server1.local",
  1059. авг 08 21:57:17 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  1060. авг 08 21:57:17 server1.local filebeat[10446]: "version": "7.2.0",
  1061. авг 08 21:57:17 server1.local filebeat[10446]: "type": "filebeat"
  1062. авг 08 21:57:17 server1.local filebeat[10446]: }
  1063. авг 08 21:57:17 server1.local filebeat[10446]: }
  1064. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.367+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  1065. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [9: 0, 1]
  1066. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=10, end-seq=10
  1067. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  1068. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  1069. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  1070. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  1071. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  1072. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.368+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  1073. авг 08 21:57:18 server1.local filebeat[10446]: 2019-08-08T21:57:18.372+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  1074. авг 08 21:57:19 server1.local filebeat[10446]: 2019-08-08T21:57:19.367+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1075. авг 08 21:57:19 server1.local filebeat[10446]: 2019-08-08T21:57:19.372+0300 DEBUG [input] input/input.go:152 Run input
  1076. авг 08 21:57:19 server1.local filebeat[10446]: 2019-08-08T21:57:19.372+0300 DEBUG [input] log/input.go:187 Start next scan
  1077. авг 08 21:57:19 server1.local filebeat[10446]: 2019-08-08T21:57:19.372+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1078. авг 08 21:57:19 server1.local filebeat[10446]: 2019-08-08T21:57:19.372+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036859
  1079. авг 08 21:57:19 server1.local filebeat[10446]: 2019-08-08T21:57:19.372+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1080. авг 08 21:57:19 server1.local filebeat[10446]: 2019-08-08T21:57:19.372+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1081. авг 08 21:57:22 server1.local filebeat[10446]: 2019-08-08T21:57:22.372+0300 DEBUG [input] input/input.go:152 Run input
  1082. авг 08 21:57:22 server1.local filebeat[10446]: 2019-08-08T21:57:22.372+0300 DEBUG [input] log/input.go:187 Start next scan
  1083. авг 08 21:57:22 server1.local filebeat[10446]: 2019-08-08T21:57:22.372+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1084. авг 08 21:57:22 server1.local filebeat[10446]: 2019-08-08T21:57:22.372+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036859
  1085. авг 08 21:57:22 server1.local filebeat[10446]: 2019-08-08T21:57:22.372+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1086. авг 08 21:57:22 server1.local filebeat[10446]: 2019-08-08T21:57:22.372+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1087. авг 08 21:57:25 server1.local filebeat[10446]: 2019-08-08T21:57:25.373+0300 DEBUG [input] input/input.go:152 Run input
  1088. авг 08 21:57:25 server1.local filebeat[10446]: 2019-08-08T21:57:25.373+0300 DEBUG [input] log/input.go:187 Start next scan
  1089. авг 08 21:57:25 server1.local filebeat[10446]: 2019-08-08T21:57:25.373+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1090. авг 08 21:57:25 server1.local filebeat[10446]: 2019-08-08T21:57:25.373+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036859
  1091. авг 08 21:57:25 server1.local filebeat[10446]: 2019-08-08T21:57:25.373+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1092. авг 08 21:57:25 server1.local filebeat[10446]: 2019-08-08T21:57:25.373+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1093. авг 08 21:57:27 server1.local filebeat[10446]: 2019-08-08T21:57:27.368+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1094. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.341+0300 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":110,"time":{"ms":10}},"total":{"ticks":290,"time":{"ms":26},"value":290},"user":{"ticks":180,"time":{"ms":16}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":7},"info":{"ephemeral_id":"ff21c997-2f19-4d77-ac3d-a9757df39597","uptime":{"ms":120056}},"memstats":{"gc_next":6726736,"memory_alloc":5194488,"memory_total":23964320},"runtime":{"goroutines":26}},"filebeat":{"events":{"added":2,"done":2},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":2,"batches":2,"total":2},"read":{"bytes":12},"write":{"bytes":1652}},"pipeline":{"clients":1,"events":{"active":0,"published":2,"total":2},"queue":{"acked":2}}},"registrar":{"states":{"current":5,"update":2},"writes":{"success":2,"total":2}},"system":{"load":{"1":0.07,"15":0.15,"5":0.16,"norm":{"1":0.0175,"15":0.0375,"5":0.04}}}}}}
  1095. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.368+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1096. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.373+0300 DEBUG [input] input/input.go:152 Run input
  1097. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.373+0300 DEBUG [input] log/input.go:187 Start next scan
  1098. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.373+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1099. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.373+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036859
  1100. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.373+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1101. авг 08 21:57:28 server1.local filebeat[10446]: 2019-08-08T21:57:28.373+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1102. авг 08 21:57:30 server1.local filebeat[10446]: 2019-08-08T21:57:30.369+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1103. авг 08 21:57:31 server1.local filebeat[10446]: 2019-08-08T21:57:31.369+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1104. авг 08 21:57:31 server1.local filebeat[10446]: 2019-08-08T21:57:31.374+0300 DEBUG [input] input/input.go:152 Run input
  1105. авг 08 21:57:31 server1.local filebeat[10446]: 2019-08-08T21:57:31.374+0300 DEBUG [input] log/input.go:187 Start next scan
  1106. авг 08 21:57:31 server1.local filebeat[10446]: 2019-08-08T21:57:31.374+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1107. авг 08 21:57:31 server1.local filebeat[10446]: 2019-08-08T21:57:31.374+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036859
  1108. авг 08 21:57:31 server1.local filebeat[10446]: 2019-08-08T21:57:31.374+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1109. авг 08 21:57:31 server1.local filebeat[10446]: 2019-08-08T21:57:31.374+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1110. авг 08 21:57:33 server1.local filebeat[10446]: 2019-08-08T21:57:33.369+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1111. авг 08 21:57:34 server1.local filebeat[10446]: 2019-08-08T21:57:34.374+0300 DEBUG [input] input/input.go:152 Run input
  1112. авг 08 21:57:34 server1.local filebeat[10446]: 2019-08-08T21:57:34.374+0300 DEBUG [input] log/input.go:187 Start next scan
  1113. авг 08 21:57:34 server1.local filebeat[10446]: 2019-08-08T21:57:34.374+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1114. авг 08 21:57:34 server1.local filebeat[10446]: 2019-08-08T21:57:34.375+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10036859
  1115. авг 08 21:57:34 server1.local filebeat[10446]: 2019-08-08T21:57:34.375+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1116. авг 08 21:57:34 server1.local filebeat[10446]: 2019-08-08T21:57:34.375+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1117. авг 08 21:57:35 server1.local filebeat[10446]: 2019-08-08T21:57:35.369+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  1118. авг 08 21:57:35 server1.local filebeat[10446]: 2019-08-08T21:57:35.369+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  1119. авг 08 21:57:35 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:57:27.367Z",
  1120. авг 08 21:57:35 server1.local filebeat[10446]: "@metadata": {
  1121. авг 08 21:57:35 server1.local filebeat[10446]: "beat": "filebeat",
  1122. авг 08 21:57:35 server1.local filebeat[10446]: "type": "_doc",
  1123. авг 08 21:57:35 server1.local filebeat[10446]: "version": "7.2.0"
  1124. авг 08 21:57:35 server1.local filebeat[10446]: },
  1125. авг 08 21:57:35 server1.local filebeat[10446]: "shorthostname": "server1",
  1126. авг 08 21:57:35 server1.local filebeat[10446]: "ecs": {
  1127. авг 08 21:57:35 server1.local filebeat[10446]: "version": "1.0.0"
  1128. авг 08 21:57:35 server1.local filebeat[10446]: },
  1129. авг 08 21:57:35 server1.local filebeat[10446]: "host": {
  1130. авг 08 21:57:35 server1.local filebeat[10446]: "name": "server1.local",
  1131. авг 08 21:57:35 server1.local filebeat[10446]: "hostname": "server1.local",
  1132. авг 08 21:57:35 server1.local filebeat[10446]: "architecture": "x86_64",
  1133. авг 08 21:57:35 server1.local filebeat[10446]: "os": {
  1134. авг 08 21:57:35 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  1135. авг 08 21:57:35 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  1136. авг 08 21:57:35 server1.local filebeat[10446]: "codename": "Maipo",
  1137. авг 08 21:57:35 server1.local filebeat[10446]: "platform": "rhel",
  1138. авг 08 21:57:35 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  1139. авг 08 21:57:35 server1.local filebeat[10446]: "family": "redhat"
  1140. авг 08 21:57:35 server1.local filebeat[10446]: },
  1141. авг 08 21:57:35 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  1142. авг 08 21:57:35 server1.local filebeat[10446]: "containerized": false
  1143. авг 08 21:57:35 server1.local filebeat[10446]: },
  1144. авг 08 21:57:35 server1.local filebeat[10446]: "log": {
  1145. авг 08 21:57:35 server1.local filebeat[10446]: "offset": 10036859,
  1146. авг 08 21:57:35 server1.local filebeat[10446]: "file": {
  1147. авг 08 21:57:35 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  1148. авг 08 21:57:35 server1.local filebeat[10446]: },
  1149. авг 08 21:57:35 server1.local filebeat[10446]: "flags": [
  1150. авг 08 21:57:35 server1.local filebeat[10446]: "multiline"
  1151. авг 08 21:57:35 server1.local filebeat[10446]: ]
  1152. авг 08 21:57:35 server1.local filebeat[10446]: },
  1153. авг 08 21:57:35 server1.local filebeat[10446]: "message": "08-08-2019 21:57:20.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:20.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:20.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:20.006 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:20.007 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:20.007 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:20.018 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:20.018 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:30.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:30.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:30.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:30.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:30.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:30.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:30.003 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  1154. авг 08 21:57:35 server1.local filebeat[10446]: "input": {
  1155. авг 08 21:57:35 server1.local filebeat[10446]: "type": "log"
  1156. авг 08 21:57:35 server1.local filebeat[10446]: },
  1157. авг 08 21:57:35 server1.local filebeat[10446]: "system": "pgp",
  1158. авг 08 21:57:35 server1.local filebeat[10446]: "log_name": "auction",
  1159. авг 08 21:57:35 server1.local filebeat[10446]: "component": "app",
  1160. авг 08 21:57:35 server1.local filebeat[10446]: "env": "test",
  1161. авг 08 21:57:35 server1.local filebeat[10446]: "agent": {
  1162. авг 08 21:57:35 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  1163. авг 08 21:57:35 server1.local filebeat[10446]: "hostname": "server1.local",
  1164. авг 08 21:57:35 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  1165. авг 08 21:57:35 server1.local filebeat[10446]: "version": "7.2.0",
  1166. авг 08 21:57:35 server1.local filebeat[10446]: "type": "filebeat"
  1167. авг 08 21:57:35 server1.local filebeat[10446]: }
  1168. авг 08 21:57:35 server1.local filebeat[10446]: }
  1169. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.371+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  1170. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.372+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [10: 0, 1]
  1171. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.372+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=11, end-seq=11
  1172. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.373+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  1173. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.373+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  1174. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.373+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  1175. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.373+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  1176. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.373+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  1177. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.373+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  1178. авг 08 21:57:36 server1.local filebeat[10446]: 2019-08-08T21:57:36.376+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  1179. авг 08 21:57:37 server1.local filebeat[10446]: 2019-08-08T21:57:37.370+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1180. авг 08 21:57:37 server1.local filebeat[10446]: 2019-08-08T21:57:37.375+0300 DEBUG [input] input/input.go:152 Run input
  1181. авг 08 21:57:37 server1.local filebeat[10446]: 2019-08-08T21:57:37.375+0300 DEBUG [input] log/input.go:187 Start next scan
  1182. авг 08 21:57:37 server1.local filebeat[10446]: 2019-08-08T21:57:37.375+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1183. авг 08 21:57:37 server1.local filebeat[10446]: 2019-08-08T21:57:37.375+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10038523
  1184. авг 08 21:57:37 server1.local filebeat[10446]: 2019-08-08T21:57:37.375+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1185. авг 08 21:57:37 server1.local filebeat[10446]: 2019-08-08T21:57:37.375+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1186. авг 08 21:57:40 server1.local filebeat[10446]: 2019-08-08T21:57:40.375+0300 DEBUG [input] input/input.go:152 Run input
  1187. авг 08 21:57:40 server1.local filebeat[10446]: 2019-08-08T21:57:40.376+0300 DEBUG [input] log/input.go:187 Start next scan
  1188. авг 08 21:57:40 server1.local filebeat[10446]: 2019-08-08T21:57:40.376+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1189. авг 08 21:57:40 server1.local filebeat[10446]: 2019-08-08T21:57:40.376+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10038523
  1190. авг 08 21:57:40 server1.local filebeat[10446]: 2019-08-08T21:57:40.376+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1191. авг 08 21:57:40 server1.local filebeat[10446]: 2019-08-08T21:57:40.376+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1192. авг 08 21:57:43 server1.local filebeat[10446]: 2019-08-08T21:57:43.376+0300 DEBUG [input] input/input.go:152 Run input
  1193. авг 08 21:57:43 server1.local filebeat[10446]: 2019-08-08T21:57:43.376+0300 DEBUG [input] log/input.go:187 Start next scan
  1194. авг 08 21:57:43 server1.local filebeat[10446]: 2019-08-08T21:57:43.376+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1195. авг 08 21:57:43 server1.local filebeat[10446]: 2019-08-08T21:57:43.376+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10038523
  1196. авг 08 21:57:43 server1.local filebeat[10446]: 2019-08-08T21:57:43.377+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1197. авг 08 21:57:43 server1.local filebeat[10446]: 2019-08-08T21:57:43.377+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1198. авг 08 21:57:45 server1.local filebeat[10446]: 2019-08-08T21:57:45.370+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1199. авг 08 21:57:46 server1.local filebeat[10446]: 2019-08-08T21:57:46.371+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1200. авг 08 21:57:46 server1.local filebeat[10446]: 2019-08-08T21:57:46.377+0300 DEBUG [input] input/input.go:152 Run input
  1201. авг 08 21:57:46 server1.local filebeat[10446]: 2019-08-08T21:57:46.377+0300 DEBUG [input] log/input.go:187 Start next scan
  1202. авг 08 21:57:46 server1.local filebeat[10446]: 2019-08-08T21:57:46.377+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1203. авг 08 21:57:46 server1.local filebeat[10446]: 2019-08-08T21:57:46.377+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10038523
  1204. авг 08 21:57:46 server1.local filebeat[10446]: 2019-08-08T21:57:46.377+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1205. авг 08 21:57:46 server1.local filebeat[10446]: 2019-08-08T21:57:46.377+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1206. авг 08 21:57:48 server1.local filebeat[10446]: 2019-08-08T21:57:48.371+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1207. авг 08 21:57:49 server1.local filebeat[10446]: 2019-08-08T21:57:49.377+0300 DEBUG [input] input/input.go:152 Run input
  1208. авг 08 21:57:49 server1.local filebeat[10446]: 2019-08-08T21:57:49.377+0300 DEBUG [input] log/input.go:187 Start next scan
  1209. авг 08 21:57:49 server1.local filebeat[10446]: 2019-08-08T21:57:49.377+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1210. авг 08 21:57:49 server1.local filebeat[10446]: 2019-08-08T21:57:49.377+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10038523
  1211. авг 08 21:57:49 server1.local filebeat[10446]: 2019-08-08T21:57:49.377+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1212. авг 08 21:57:49 server1.local filebeat[10446]: 2019-08-08T21:57:49.378+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1213. авг 08 21:57:50 server1.local filebeat[10446]: 2019-08-08T21:57:50.371+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  1214. авг 08 21:57:50 server1.local filebeat[10446]: 2019-08-08T21:57:50.371+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  1215. авг 08 21:57:50 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:57:45.370Z",
  1216. авг 08 21:57:50 server1.local filebeat[10446]: "@metadata": {
  1217. авг 08 21:57:50 server1.local filebeat[10446]: "beat": "filebeat",
  1218. авг 08 21:57:50 server1.local filebeat[10446]: "type": "_doc",
  1219. авг 08 21:57:50 server1.local filebeat[10446]: "version": "7.2.0"
  1220. авг 08 21:57:50 server1.local filebeat[10446]: },
  1221. авг 08 21:57:50 server1.local filebeat[10446]: "input": {
  1222. авг 08 21:57:50 server1.local filebeat[10446]: "type": "log"
  1223. авг 08 21:57:50 server1.local filebeat[10446]: },
  1224. авг 08 21:57:50 server1.local filebeat[10446]: "system": "pgp",
  1225. авг 08 21:57:50 server1.local filebeat[10446]: "shorthostname": "server1",
  1226. авг 08 21:57:50 server1.local filebeat[10446]: "component": "app",
  1227. авг 08 21:57:50 server1.local filebeat[10446]: "env": "test",
  1228. авг 08 21:57:50 server1.local filebeat[10446]: "ecs": {
  1229. авг 08 21:57:50 server1.local filebeat[10446]: "version": "1.0.0"
  1230. авг 08 21:57:50 server1.local filebeat[10446]: },
  1231. авг 08 21:57:50 server1.local filebeat[10446]: "log": {
  1232. авг 08 21:57:50 server1.local filebeat[10446]: "offset": 10038523,
  1233. авг 08 21:57:50 server1.local filebeat[10446]: "file": {
  1234. авг 08 21:57:50 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  1235. авг 08 21:57:50 server1.local filebeat[10446]: },
  1236. авг 08 21:57:50 server1.local filebeat[10446]: "flags": [
  1237. авг 08 21:57:50 server1.local filebeat[10446]: "multiline"
  1238. авг 08 21:57:50 server1.local filebeat[10446]: ]
  1239. авг 08 21:57:50 server1.local filebeat[10446]: },
  1240. авг 08 21:57:50 server1.local filebeat[10446]: "message": "08-08-2019 21:57:40.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:40.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:40.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:40.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:40.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:40.011 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:40.023 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:40.023 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  1241. авг 08 21:57:50 server1.local filebeat[10446]: "log_name": "auction",
  1242. авг 08 21:57:50 server1.local filebeat[10446]: "host": {
  1243. авг 08 21:57:50 server1.local filebeat[10446]: "name": "server1.local",
  1244. авг 08 21:57:50 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  1245. авг 08 21:57:50 server1.local filebeat[10446]: "containerized": false,
  1246. авг 08 21:57:50 server1.local filebeat[10446]: "hostname": "server1.local",
  1247. авг 08 21:57:50 server1.local filebeat[10446]: "architecture": "x86_64",
  1248. авг 08 21:57:50 server1.local filebeat[10446]: "os": {
  1249. авг 08 21:57:50 server1.local filebeat[10446]: "family": "redhat",
  1250. авг 08 21:57:50 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  1251. авг 08 21:57:50 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  1252. авг 08 21:57:50 server1.local filebeat[10446]: "codename": "Maipo",
  1253. авг 08 21:57:50 server1.local filebeat[10446]: "platform": "rhel",
  1254. авг 08 21:57:50 server1.local filebeat[10446]: "version": "7.4 (Maipo)"
  1255. авг 08 21:57:50 server1.local filebeat[10446]: }
  1256. авг 08 21:57:50 server1.local filebeat[10446]: },
  1257. авг 08 21:57:50 server1.local filebeat[10446]: "agent": {
  1258. авг 08 21:57:50 server1.local filebeat[10446]: "type": "filebeat",
  1259. авг 08 21:57:50 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  1260. авг 08 21:57:50 server1.local filebeat[10446]: "hostname": "server1.local",
  1261. авг 08 21:57:50 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  1262. авг 08 21:57:50 server1.local filebeat[10446]: "version": "7.2.0"
  1263. авг 08 21:57:50 server1.local filebeat[10446]: }
  1264. авг 08 21:57:50 server1.local filebeat[10446]: }
  1265. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.374+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  1266. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [11: 0, 1]
  1267. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=12, end-seq=12
  1268. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  1269. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  1270. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  1271. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  1272. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  1273. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.375+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  1274. авг 08 21:57:51 server1.local filebeat[10446]: 2019-08-08T21:57:51.379+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  1275. авг 08 21:57:52 server1.local filebeat[10446]: 2019-08-08T21:57:52.372+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1276. авг 08 21:57:52 server1.local filebeat[10446]: 2019-08-08T21:57:52.378+0300 DEBUG [input] input/input.go:152 Run input
  1277. авг 08 21:57:52 server1.local filebeat[10446]: 2019-08-08T21:57:52.378+0300 DEBUG [input] log/input.go:187 Start next scan
  1278. авг 08 21:57:52 server1.local filebeat[10446]: 2019-08-08T21:57:52.378+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1279. авг 08 21:57:52 server1.local filebeat[10446]: 2019-08-08T21:57:52.378+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10039355
  1280. авг 08 21:57:52 server1.local filebeat[10446]: 2019-08-08T21:57:52.378+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1281. авг 08 21:57:52 server1.local filebeat[10446]: 2019-08-08T21:57:52.378+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1282. авг 08 21:57:53 server1.local filebeat[10446]: 2019-08-08T21:57:53.372+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1283. авг 08 21:57:55 server1.local filebeat[10446]: 2019-08-08T21:57:55.372+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1284. авг 08 21:57:55 server1.local filebeat[10446]: 2019-08-08T21:57:55.378+0300 DEBUG [input] input/input.go:152 Run input
  1285. авг 08 21:57:55 server1.local filebeat[10446]: 2019-08-08T21:57:55.378+0300 DEBUG [input] log/input.go:187 Start next scan
  1286. авг 08 21:57:55 server1.local filebeat[10446]: 2019-08-08T21:57:55.378+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1287. авг 08 21:57:55 server1.local filebeat[10446]: 2019-08-08T21:57:55.378+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10039355
  1288. авг 08 21:57:55 server1.local filebeat[10446]: 2019-08-08T21:57:55.378+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1289. авг 08 21:57:55 server1.local filebeat[10446]: 2019-08-08T21:57:55.378+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1290. авг 08 21:57:57 server1.local filebeat[10446]: 2019-08-08T21:57:57.372+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  1291. авг 08 21:57:57 server1.local filebeat[10446]: 2019-08-08T21:57:57.372+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  1292. авг 08 21:57:57 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:57:52.372Z",
  1293. авг 08 21:57:57 server1.local filebeat[10446]: "@metadata": {
  1294. авг 08 21:57:57 server1.local filebeat[10446]: "beat": "filebeat",
  1295. авг 08 21:57:57 server1.local filebeat[10446]: "type": "_doc",
  1296. авг 08 21:57:57 server1.local filebeat[10446]: "version": "7.2.0"
  1297. авг 08 21:57:57 server1.local filebeat[10446]: },
  1298. авг 08 21:57:57 server1.local filebeat[10446]: "log_name": "auction",
  1299. авг 08 21:57:57 server1.local filebeat[10446]: "agent": {
  1300. авг 08 21:57:57 server1.local filebeat[10446]: "version": "7.2.0",
  1301. авг 08 21:57:57 server1.local filebeat[10446]: "type": "filebeat",
  1302. авг 08 21:57:57 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  1303. авг 08 21:57:57 server1.local filebeat[10446]: "hostname": "server1.local",
  1304. авг 08 21:57:57 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe"
  1305. авг 08 21:57:57 server1.local filebeat[10446]: },
  1306. авг 08 21:57:57 server1.local filebeat[10446]: "ecs": {
  1307. авг 08 21:57:57 server1.local filebeat[10446]: "version": "1.0.0"
  1308. авг 08 21:57:57 server1.local filebeat[10446]: },
  1309. авг 08 21:57:57 server1.local filebeat[10446]: "shorthostname": "server1",
  1310. авг 08 21:57:57 server1.local filebeat[10446]: "host": {
  1311. авг 08 21:57:57 server1.local filebeat[10446]: "containerized": false,
  1312. авг 08 21:57:57 server1.local filebeat[10446]: "hostname": "server1.local",
  1313. авг 08 21:57:57 server1.local filebeat[10446]: "architecture": "x86_64",
  1314. авг 08 21:57:57 server1.local filebeat[10446]: "name": "server1.local",
  1315. авг 08 21:57:57 server1.local filebeat[10446]: "os": {
  1316. авг 08 21:57:57 server1.local filebeat[10446]: "version": "7.4 (Maipo)",
  1317. авг 08 21:57:57 server1.local filebeat[10446]: "family": "redhat",
  1318. авг 08 21:57:57 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  1319. авг 08 21:57:57 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  1320. авг 08 21:57:57 server1.local filebeat[10446]: "codename": "Maipo",
  1321. авг 08 21:57:57 server1.local filebeat[10446]: "platform": "rhel"
  1322. авг 08 21:57:57 server1.local filebeat[10446]: },
  1323. авг 08 21:57:57 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41"
  1324. авг 08 21:57:57 server1.local filebeat[10446]: },
  1325. авг 08 21:57:57 server1.local filebeat[10446]: "log": {
  1326. авг 08 21:57:57 server1.local filebeat[10446]: "file": {
  1327. авг 08 21:57:57 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  1328. авг 08 21:57:57 server1.local filebeat[10446]: },
  1329. авг 08 21:57:57 server1.local filebeat[10446]: "flags": [
  1330. авг 08 21:57:57 server1.local filebeat[10446]: "multiline"
  1331. авг 08 21:57:57 server1.local filebeat[10446]: ],
  1332. авг 08 21:57:57 server1.local filebeat[10446]: "offset": 10039355
  1333. авг 08 21:57:57 server1.local filebeat[10446]: },
  1334. авг 08 21:57:57 server1.local filebeat[10446]: "message": "08-08-2019 21:57:50.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:50.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:57:50.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:50.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:57:50.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:50.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:57:50.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:57:50.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  1335. авг 08 21:57:57 server1.local filebeat[10446]: "component": "app",
  1336. авг 08 21:57:57 server1.local filebeat[10446]: "env": "test",
  1337. авг 08 21:57:57 server1.local filebeat[10446]: "input": {
  1338. авг 08 21:57:57 server1.local filebeat[10446]: "type": "log"
  1339. авг 08 21:57:57 server1.local filebeat[10446]: },
  1340. авг 08 21:57:57 server1.local filebeat[10446]: "system": "pgp"
  1341. авг 08 21:57:57 server1.local filebeat[10446]: }
  1342. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.341+0300 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":130,"time":{"ms":18}},"total":{"ticks":330,"time":{"ms":39},"value":330},"user":{"ticks":200,"time":{"ms":21}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":7},"info":{"ephemeral_id":"ff21c997-2f19-4d77-ac3d-a9757df39597","uptime":{"ms":150055}},"memstats":{"gc_next":6698688,"memory_alloc":3531480,"memory_total":27478448,"rss":2097152},"runtime":{"goroutines":26}},"filebeat":{"events":{"active":1,"added":3,"done":2},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":2,"batches":2,"total":2},"read":{"bytes":12},"write":{"bytes":1534}},"pipeline":{"clients":1,"events":{"active":1,"published":3,"total":3},"queue":{"acked":2}}},"registrar":{"states":{"current":5,"update":2},"writes":{"success":2,"total":2}},"system":{"load":{"1":0.04,"15":0.15,"5":0.15,"norm":{"1":0.01,"15":0.0375,"5":0.0375}}}}}}
  1343. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.374+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  1344. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [12: 0, 1]
  1345. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=13, end-seq=13
  1346. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  1347. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  1348. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  1349. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  1350. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  1351. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.375+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  1352. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.378+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  1353. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.379+0300 DEBUG [input] input/input.go:152 Run input
  1354. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.379+0300 DEBUG [input] log/input.go:187 Start next scan
  1355. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.379+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1356. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.379+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10040187
  1357. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.379+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1358. авг 08 21:57:58 server1.local filebeat[10446]: 2019-08-08T21:57:58.379+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1359. авг 08 21:57:59 server1.local filebeat[10446]: 2019-08-08T21:57:59.373+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1360. авг 08 21:58:01 server1.local filebeat[10446]: 2019-08-08T21:58:01.380+0300 DEBUG [input] input/input.go:152 Run input
  1361. авг 08 21:58:01 server1.local filebeat[10446]: 2019-08-08T21:58:01.380+0300 DEBUG [input] log/input.go:187 Start next scan
  1362. авг 08 21:58:01 server1.local filebeat[10446]: 2019-08-08T21:58:01.380+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1363. авг 08 21:58:01 server1.local filebeat[10446]: 2019-08-08T21:58:01.380+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10040187
  1364. авг 08 21:58:01 server1.local filebeat[10446]: 2019-08-08T21:58:01.380+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1365. авг 08 21:58:01 server1.local filebeat[10446]: 2019-08-08T21:58:01.380+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1366. авг 08 21:58:04 server1.local filebeat[10446]: 2019-08-08T21:58:04.381+0300 DEBUG [input] input/input.go:152 Run input
  1367. авг 08 21:58:04 server1.local filebeat[10446]: 2019-08-08T21:58:04.381+0300 DEBUG [input] log/input.go:187 Start next scan
  1368. авг 08 21:58:04 server1.local filebeat[10446]: 2019-08-08T21:58:04.381+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1369. авг 08 21:58:04 server1.local filebeat[10446]: 2019-08-08T21:58:04.382+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10040187
  1370. авг 08 21:58:04 server1.local filebeat[10446]: 2019-08-08T21:58:04.382+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1371. авг 08 21:58:04 server1.local filebeat[10446]: 2019-08-08T21:58:04.382+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1372. авг 08 21:58:07 server1.local filebeat[10446]: 2019-08-08T21:58:07.374+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1373. авг 08 21:58:07 server1.local filebeat[10446]: 2019-08-08T21:58:07.382+0300 DEBUG [input] input/input.go:152 Run input
  1374. авг 08 21:58:07 server1.local filebeat[10446]: 2019-08-08T21:58:07.382+0300 DEBUG [input] log/input.go:187 Start next scan
  1375. авг 08 21:58:07 server1.local filebeat[10446]: 2019-08-08T21:58:07.382+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1376. авг 08 21:58:07 server1.local filebeat[10446]: 2019-08-08T21:58:07.382+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10040187
  1377. авг 08 21:58:07 server1.local filebeat[10446]: 2019-08-08T21:58:07.382+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1378. авг 08 21:58:07 server1.local filebeat[10446]: 2019-08-08T21:58:07.382+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1379. авг 08 21:58:08 server1.local filebeat[10446]: 2019-08-08T21:58:08.375+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1380. авг 08 21:58:10 server1.local filebeat[10446]: 2019-08-08T21:58:10.375+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1381. авг 08 21:58:10 server1.local filebeat[10446]: 2019-08-08T21:58:10.383+0300 DEBUG [input] input/input.go:152 Run input
  1382. авг 08 21:58:10 server1.local filebeat[10446]: 2019-08-08T21:58:10.383+0300 DEBUG [input] log/input.go:187 Start next scan
  1383. авг 08 21:58:10 server1.local filebeat[10446]: 2019-08-08T21:58:10.383+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1384. авг 08 21:58:10 server1.local filebeat[10446]: 2019-08-08T21:58:10.383+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10040187
  1385. авг 08 21:58:10 server1.local filebeat[10446]: 2019-08-08T21:58:10.383+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1386. авг 08 21:58:10 server1.local filebeat[10446]: 2019-08-08T21:58:10.383+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1387. авг 08 21:58:11 server1.local filebeat[10446]: 2019-08-08T21:58:11.376+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1388. авг 08 21:58:13 server1.local filebeat[10446]: 2019-08-08T21:58:13.376+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
  1389. авг 08 21:58:13 server1.local filebeat[10446]: 2019-08-08T21:58:13.383+0300 DEBUG [input] input/input.go:152 Run input
  1390. авг 08 21:58:13 server1.local filebeat[10446]: 2019-08-08T21:58:13.383+0300 DEBUG [input] log/input.go:187 Start next scan
  1391. авг 08 21:58:13 server1.local filebeat[10446]: 2019-08-08T21:58:13.384+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1392. авг 08 21:58:13 server1.local filebeat[10446]: 2019-08-08T21:58:13.384+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10040187
  1393. авг 08 21:58:13 server1.local filebeat[10446]: 2019-08-08T21:58:13.384+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1394. авг 08 21:58:13 server1.local filebeat[10446]: 2019-08-08T21:58:13.384+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1395. авг 08 21:58:15 server1.local filebeat[10446]: 2019-08-08T21:58:15.376+0300 DEBUG [multiline] multiline/multiline.go:175 Multiline event flushed because timeout reached.
  1396. авг 08 21:58:15 server1.local filebeat[10446]: 2019-08-08T21:58:15.377+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
  1397. авг 08 21:58:15 server1.local filebeat[10446]: "@timestamp": "2019-08-08T18:58:07.373Z",
  1398. авг 08 21:58:15 server1.local filebeat[10446]: "@metadata": {
  1399. авг 08 21:58:15 server1.local filebeat[10446]: "beat": "filebeat",
  1400. авг 08 21:58:15 server1.local filebeat[10446]: "type": "_doc",
  1401. авг 08 21:58:15 server1.local filebeat[10446]: "version": "7.2.0"
  1402. авг 08 21:58:15 server1.local filebeat[10446]: },
  1403. авг 08 21:58:15 server1.local filebeat[10446]: "log": {
  1404. авг 08 21:58:15 server1.local filebeat[10446]: "offset": 10040187,
  1405. авг 08 21:58:15 server1.local filebeat[10446]: "file": {
  1406. авг 08 21:58:15 server1.local filebeat[10446]: "path": "/var/log/weblogic/weblogic.log"
  1407. авг 08 21:58:15 server1.local filebeat[10446]: },
  1408. авг 08 21:58:15 server1.local filebeat[10446]: "flags": [
  1409. авг 08 21:58:15 server1.local filebeat[10446]: "multiline"
  1410. авг 08 21:58:15 server1.local filebeat[10446]: ]
  1411. авг 08 21:58:15 server1.local filebeat[10446]: },
  1412. авг 08 21:58:15 server1.local filebeat[10446]: "component": "app",
  1413. авг 08 21:58:15 server1.local filebeat[10446]: "input": {
  1414. авг 08 21:58:15 server1.local filebeat[10446]: "type": "log"
  1415. авг 08 21:58:15 server1.local filebeat[10446]: },
  1416. авг 08 21:58:15 server1.local filebeat[10446]: "system": "pgp",
  1417. авг 08 21:58:15 server1.local filebeat[10446]: "log_name": "auction",
  1418. авг 08 21:58:15 server1.local filebeat[10446]: "agent": {
  1419. авг 08 21:58:15 server1.local filebeat[10446]: "ephemeral_id": "ff21c997-2f19-4d77-ac3d-a9757df39597",
  1420. авг 08 21:58:15 server1.local filebeat[10446]: "hostname": "server1.local",
  1421. авг 08 21:58:15 server1.local filebeat[10446]: "id": "38a4b45d-f325-4c19-9bcf-79b583cdaefe",
  1422. авг 08 21:58:15 server1.local filebeat[10446]: "version": "7.2.0",
  1423. авг 08 21:58:15 server1.local filebeat[10446]: "type": "filebeat"
  1424. авг 08 21:58:15 server1.local filebeat[10446]: },
  1425. авг 08 21:58:15 server1.local filebeat[10446]: "message": "08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:00.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:00.012 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:00.012 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:00.012 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:00.012 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:00.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:58:00.013 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:58:00.013 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Starting scheduled archiveJob() - Thu Aug 08 21:58:00 GMT+03:00 2019\n08-08-2019 21:58:00.013 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Starting scheduled archiveJob() - Thu Aug 08 21:58:00 GMT+03:00 2019\n08-08-2019 21:58:00.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:00.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:00.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:00.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:00.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:00.014 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:00.024 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:58:00.024 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:58:00.029 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:58:00.029 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:58:00.061 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Scheduled archiving is disabled\n08-08-2019 21:58:00.061 DEBUG r.f.t.a.s.impl.ArchiveServiceImpl - Scheduled archiving is disabled\n08-08-2019 21:58:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:10.001 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - current user name is null\n08-08-2019 21:58:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - replace username by EOS\n08-08-2019 21:58:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:10.002 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - trying to call DBMS_SESSION.SET_IDENTIFIER(EOS)\n08-08-2019 21:58:10.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed\n08-08-2019 21:58:10.004 TRACE r.f.t.a.l.s.UserLoginProxyDataSource - DBMS_SESSION.SET_IDENTIFIER(EOS) executed",
  1426. авг 08 21:58:15 server1.local filebeat[10446]: "env": "test",
  1427. авг 08 21:58:15 server1.local filebeat[10446]: "shorthostname": "server1",
  1428. авг 08 21:58:15 server1.local filebeat[10446]: "ecs": {
  1429. авг 08 21:58:15 server1.local filebeat[10446]: "version": "1.0.0"
  1430. авг 08 21:58:15 server1.local filebeat[10446]: },
  1431. авг 08 21:58:15 server1.local filebeat[10446]: "host": {
  1432. авг 08 21:58:15 server1.local filebeat[10446]: "hostname": "server1.local",
  1433. авг 08 21:58:15 server1.local filebeat[10446]: "architecture": "x86_64",
  1434. авг 08 21:58:15 server1.local filebeat[10446]: "os": {
  1435. авг 08 21:58:15 server1.local filebeat[10446]: "family": "redhat",
  1436. авг 08 21:58:15 server1.local filebeat[10446]: "name": "Red Hat Enterprise Linux Server",
  1437. авг 08 21:58:15 server1.local filebeat[10446]: "kernel": "3.10.0-1062.el7.x86_64",
  1438. авг 08 21:58:15 server1.local filebeat[10446]: "codename": "Maipo",
  1439. авг 08 21:58:15 server1.local filebeat[10446]: "platform": "rhel",
  1440. авг 08 21:58:15 server1.local filebeat[10446]: "version": "7.4 (Maipo)"
  1441. авг 08 21:58:15 server1.local filebeat[10446]: },
  1442. авг 08 21:58:15 server1.local filebeat[10446]: "name": "server1.local",
  1443. авг 08 21:58:15 server1.local filebeat[10446]: "id": "8930f2efbd4a4e75a22237a0c20f8f41",
  1444. авг 08 21:58:15 server1.local filebeat[10446]: "containerized": false
  1445. авг 08 21:58:15 server1.local filebeat[10446]: }
  1446. авг 08 21:58:15 server1.local filebeat[10446]: }
  1447. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.379+0300 DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host logstash:3090. Continue sending
  1448. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [publisher] memqueue/ackloop.go:160 ackloop: receive ack [13: 0, 1]
  1449. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [publisher] memqueue/eventloop.go:535 broker ACK events: count=1, start-seq=14, end-seq=14
  1450. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [publisher] memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
  1451. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [publisher] memqueue/ackloop.go:131 ackloop: done send ack
  1452. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
  1453. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
  1454. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
  1455. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.381+0300 DEBUG [registrar] registrar/registrar.go:411 Write registry file: /var/lib/filebeat/registry/filebeat/data.json (5)
  1456. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.384+0300 DEBUG [input] input/input.go:152 Run input
  1457. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.384+0300 DEBUG [input] log/input.go:187 Start next scan
  1458. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.384+0300 DEBUG [input] log/input.go:417 Check file for harvesting: /var/log/weblogic/weblogic.log
  1459. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.384+0300 DEBUG [input] log/input.go:507 Update existing file for harvesting: /var/log/weblogic/weblogic.log, offset: 10043981
  1460. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.385+0300 DEBUG [input] log/input.go:559 Harvester for file is still running: /var/log/weblogic/weblogic.log
  1461. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.385+0300 DEBUG [input] log/input.go:208 input states cleaned up. Before: 1, After: 1, Pending: 0
  1462. авг 08 21:58:16 server1.local filebeat[10446]: 2019-08-08T21:58:16.391+0300 DEBUG [registrar] registrar/registrar.go:404 Registry file updated. 5 states written.
  1463. авг 08 21:58:17 server1.local filebeat[10446]: 2019-08-08T21:58:17.377+0300 DEBUG [harvester] log/log.go:102 End of file reached: /var/log/weblogic/weblogic.log; Backoff now.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!