I need to add two different input plugins in logstash i.e. Filebeat and jdbc but only jdbc is working. I am not sure is this the right way i am adding both of them? Please let me know what to do in this kind of scenario:
input {
beats{
port=> "5044"
}
jdbc {
jdbc_driver_library => "C:\Program Files\Microsoft JDBC Driver 6.0 for SQL Server\sqljdbc_6.0\enu\jre8\sqljdbc42.jar"
jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc_connection_string => "jdbc:sqlserver://myserverName:PortName;user=IntegrationUser;password=AHCS@12345;database=QAEsbExceptionDb;"
jdbc_user => "myuser"
jdbc_password => "mypassword"
statement => "SELECT * FROM [Fault]"
type => "esblogs"
}
}
filter {
if [type] == "log"{
grok{
match =>{"message"=>"%{TIMESTAMP_ISO8601:logtime} -[0-9]{2}:[0-9]{2} [%{LOGLEVEL:LogLevel}"}
add_field => [ "Received_at", "%{@timestamp}" ]
remove_field => ["@version", "offset", "tags"]
}
date{
match => [ "logtime", "YYYY-MM-dd HH:mm:ss.SSS" ]
target => "@timestamp"
}
}
}
output {
elasticsearch{
hosts => "localhost:9200"
index => "%{type}"
document_type => "doc"
}
}