Allow DBID to be empty & Correct case matching

[Dylan-M]

The DBID field is able to be empty on some versions of Oracle DB
The multiline regex was looking for Audit File, but logs have Audit file

[jsirianni]

The following config does not work for me

pipeline:
- type: oracledb
  enable_audit_log: true
  enable_truncate_audit_action: false
  enable_alert_log: false
  enable_listener_log: true

  audit_log_path: "/home/jsirianni/git/log-library/library/oracledb/audit*"
  alert_log_path: "/home/jsirianni/git/log-library/library/oracledb/alert*"
  listener_log_path: /home/jsirianni/git/log-library/library/oracledb/list*

  start_at: beginning
  
- type: file_output
  path: ./out

{"level":"error","timestamp":"2021-09-20T11:01:37.051-0400","message":"Failed to build agent","error":{"description":"operator '$.oracledb.[$.file_output]' does not exist","details":{"operator_id":"$.oracledb.audit_regex_parser"}}}

If I do enable_truncate_audit_action: true, it starts fine.

[jsirianni]

I get the following:

➜  stanza-plugins git:(dbid-empty) ✗ ./stanza_linux_amd64 --config ./config.yaml | jq .
{"level":"info","timestamp":"2021-09-20T11:04:10.630-0400","message":"Starting stanza agent"}
{"level":"info","timestamp":"2021-09-20T11:04:10.630-0400","message":"Stanza agent started"}
{"level":"info","timestamp":"2021-09-20T11:04:10.830-0400","message":"Started watching file","operator_id":"$.oracledb.listener_reader","operator_type":"file_input","path":"/home/jsirianni/git/log-library/library/oracledb/listener.log"}
{"level":"info","timestamp":"2021-09-20T11:04:10.831-0400","message":"Started watching file","operator_id":"$.oracledb.listener_reader","operator_type":"file_input","path":"/home/jsirianni/git/log-library/library/oracledb/listener.xml"}
{"level":"info","timestamp":"2021-09-20T11:04:10.831-0400","message":"Started watching file","operator_id":"$.oracledb.listener_reader","operator_type":"file_input","path":"/home/jsirianni/git/log-library/library/oracledb/listener2.log"}
{"level":"info","timestamp":"2021-09-20T11:04:10.831-0400","message":"Started watching file","operator_id":"$.oracledb.listener_reader","operator_type":"file_input","path":"/home/jsirianni/git/log-library/library/oracledb/listener_DB12C_log.xml"}
{"level":"info","timestamp":"2021-09-20T11:04:10.831-0400","message":"Started watching file","operator_id":"$.oracledb.listener_reader","operator_type":"file_input","path":"/home/jsirianni/git/log-library/library/oracledb/listener_DB19C_log.xml"}
{"level":"info","timestamp":"2021-09-20T11:04:10.831-0400","message":"Started watching file","operator_id":"$.oracledb.audit_reader","operator_type":"file_input","path":"/home/jsirianni/git/log-library/library/oracledb/audit.log"}
{"level":"info","timestamp":"2021-09-20T11:04:10.831-0400","message":"Started watching file","operator_id":"$.oracledb.audit_reader","operator_type":"file_input","path":"/home/jsirianni/git/log-library/library/oracledb/audit2.log"}
{"level":"error","timestamp":"2021-09-20T11:04:10.833-0400","message":"Failed to process entry","operator_id":"$.oracledb.audit_regex_parser","operator_type":"regex_parser","error":"regex pattern does not match","action":"send","entry":{"timestamp":"2021-09-20T11:04:10.833194324-04:00","severity":0,"labels":{"file_name":"audit.log","log_type":"oracledb.audit","plugin_id":"oracledb"},"record":"Sat Jun 27 16:07:30 2020 -04:00\nLENGTH : '5988'\nACTION :[5732] 'DECLARE\n  reloading_registry BOOLEAN := FALSE;\n  current_type NUMBER;\n  table_name_122 VARCHAR2(30);\n  constraint_name_122 VARCHAR2(30);\n\n"}}
{"level":"error","timestamp":"2021-09-20T11:04:10.833-0400","message":"Failed to process entry","operator_id":"$.oracledb.audit_action_restructurer","operator_type":"restructure","error":"evaluate value_expr: invalid operation: int(string) (1:7)\n | len($.action) > 150000 ? $.action[0:150000] + \"... Action has \" + $.length + \" characters which is over the 150000 characters limit, truncating action\" : $.action\n | ......^","action":"send","entry":{"timestamp":"2021-09-20T11:04:10.833194324-04:00","severity":0,"labels":{"file_name":"audit.log","log_type":"oracledb.audit","plugin_id":"oracledb"},"record":"Sat Jun 27 16:07:30 2020 -04:00\nLENGTH : '5988'\nACTION :[5732] 'DECLARE\n  reloading_registry BOOLEAN := FALSE;\n  current_type NUMBER;\n  table_name_122 VARCHAR2(30);\n  constraint_name_122 VARCHAR2(30);\n\n"}}
{"level":"error","timestamp":"2021-09-20T11:04:10.833-0400","message":"error while writing entry: evaluate value_expr: invalid operation: int(string) (1:7)\n | len($.action) > 150000 ? $.action[0:150000] + \"... Action has \" + $.length + \" characters which is over the 150000 characters limit, truncating action\" : $.action\n | ......^","operator_id":"$.oracledb.audit_regex_parser","operator_type":"regex_parser"}
{"level":"error","timestamp":"2021-09-20T11:04:10.834-0400","message":"Failed to process entry","operator_id":"$.oracledb.audit_regex_parser","operator_type":"regex_parser","error":"regex pattern does not match","action":"send","entry":{"timestamp":"2021-09-20T11:04:10.834316275-04:00","severity":0,"labels":{"file_name":"audit.log","log_type":"oracledb.audit","plugin_id":"oracledb"},"record":"Sat Jun 27 16:07:56 2020 -04:00\nLENGTH : '9090'\nACTION :[8834] 'CREATE OR REPLACE PACKAGE dbms_registry AS\n\n"}}
{"level":"error","timestamp":"2021-09-20T11:04:10.834-0400","message":"Failed to process entry","operator_id":"$.oracledb.audit_action_restructurer","operator_type":"restructure","error":"evaluate value_expr: invalid operation: int(string) (1:7)\n | len($.action) > 150000 ? $.action[0:150000] + \"... Action has \" + $.length + \" characters which is over the 150000 characters limit, truncating action\" : $.action\n | ......^","action":"send","entry":{"timestamp":"2021-09-20T11:04:10.834316275-04:00","severity":0,"labels":{"file_name":"audit.log","log_type":"oracledb.audit","plugin_id":"oracledb"},"record":"Sat Jun 27 16:07:56 2020 -04:00\nLENGTH : '9090'\nACTION :[8834] 'CREATE OR REPLACE PACKAGE dbms_registry AS\n\n"}}
{"level":"error","timestamp":"2021-09-20T11:04:10.834-0400","message":"error while writing entry: evaluate value_expr: invalid operation: int(string) (1:7)\n | len($.action) > 150000 ? $.action[0:150000] + \"... Action has \" + $.length + \" characters which is over the 150000 characters limit, truncating action\" : $.action\n | ......^","operator_id":"$.oracledb.audit_regex_parser","operator_type":"regex_parser"}
{"level":"error","timestamp":"2021-09-20T11:04:10.835-0400","message":"Failed to process entry","operator_id":"$.oracledb.audit_regex_parser","operator_type":"regex_parser","error":"regex pattern does not match","action":"send","entry":{"timestamp":"2021-09-20T11:04:10.835840606-04:00","severity":0,"labels":{"file_name":"audit.log","log_type":"oracledb.audit","plugin_id":"oracledb"},"record":"Sat Jun 27 16:09:23 2020 -04:00\nLENGTH : '42061'\nACTION :[41804] 'create or replace package drixmd authid definer is\n\n"}}
{"level":"error","timestamp":"2021-09-20T11:04:10.835-0400","message":"Failed to process entry","operator_id":"$.oracledb.audit_action_restructurer","operator_type":"restructure","error":"evaluate value_expr: invalid operation: int(string) (1:7)\n | len($.action) > 150000 ? $.action[0:150000] + \"... Action has \" + $.length + \" characters which is over the 150000 characters limit, truncating action\" : $.action\n | ......^","action":"send","entry":{"timestamp":"2021-09-20T11:04:10.835840606-04:00","severity":0,"labels":{"file_name":"audit.log","log_type":"oracledb.audit","plugin_id":"oracledb"},"record":"Sat Jun 27 16:09:23 2020 -04:00\nLENGTH : '42061'\nACTION :[41804] 'create or replace package drixmd authid definer is\n\n"}}
{"level":"error","timestamp":"2021-09-20T11:04:10.835-0400","message":"error while writing entry: evaluate value_expr: invalid operation: int(string) (1:7)\n | len($.action) > 150000 ? $.action[0:150000] + \"... Action has \" + $.length + \" characters which is over the 150000 characters limit, truncating action\" : $.action\n | ......^","operator_id":"$.oracledb.audit_regex_parser","operator_type":"regex_parser"}