# Concat query is not working in logstash

**URL:** <https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004>\
**Category:** Logstash\
**Created:** [June 7, 2018, 1:46pm UTC](https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004 "2018-06-07T13:46:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Deepak\_Dandotiya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepak_dandotiya/32/31843_2.png) [@Deepak\_Dandotiya](https://discuss.elastic.co/u/Deepak_Dandotiya)\
**Post date:** [June 7, 2018, 1:46pm UTC](https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004/1 "2018-06-07T13:46:49Z")

</div>

Hi,

I am trying to combine 2 fields first name & last name and trying to populate as single field but getting some error. Below is my Logstash config file **emp-index-logstash.conf** :-

input {

```
jdbc {

    jdbc_connection_string => "jdbc:oracle:thin:@//10.65.40.144:1521/ORCL"

    jdbc_user => "deepshara"

    jdbc_password => "deepshar"

    jdbc_validate_connection => true

    jdbc_driver_library => "/data/isuser/ojdbc6.jar"

    jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"

    statement => 'SELECT employee_id, concat(concat(first_name,' '), last_name) "employee_name", email, phone_number, hire_date, job_id, salary, commission_pct, manager_id, department_id FROM deepshara.employees ORDER BY hire_date ASC'

}

```

}

output {

```
elasticsearch {

    index => "employee"

    document_type => "emp_data"

    hosts => ["10.75.155.35:18002"]

}
    stdout{

            codec=>rubydebug

    }

```

can anyone help me where i am going wrong.

Thanks,  
Deepak

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 7, 2018, 3:13pm UTC](https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004/2 "2018-06-07T15:13:34Z")

</div>

What error are you getting?

---

<div class="post-metadata">

**Author:** ![Deepak\_Dandotiya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepak_dandotiya/32/31843_2.png) [@Deepak\_Dandotiya](https://discuss.elastic.co/u/Deepak_Dandotiya)\
**Post date:** [June 8, 2018, 4:00am UTC](https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004/3 "2018-06-08T04:00:59Z")

</div>

Below is the content from logfile **logstash-plain.log** :-

Sending Logstash's logs to /data/elk/logstash-6.2.4/logs which is now configured via log4j2.properties  
[2018-06-08T09:19:06,066][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/data/elk/logstash-6.2.4/modules/fb\_apache/configuration"}  
[2018-06-08T09:19:06,099][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"/data/elk/logstash-6.2.4/modules/netflow/configuration"}  
[2018-06-08T09:19:06,696][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2018-06-08T09:19:07,590][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.2.4"}  
[2018-06-08T09:19:08,073][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>xyx}  
[2018-06-08T09:19:08,827][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 20, column 5 (byte 589) after input {\n\n jdbc {\n\n jdbc\_connection\_string =\> "jdbc:oracle:thin:@//local:1521/ORCL"\n\n jdbc\_user =\> "deepshara"\n\n jdbc\_password =\> "deepshar"\n\n jdbc\_validate\_connection =\> true\n\n jdbc\_driver\_library =\> "/data/elk/ojdbc6.jar"\n\n jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver"\n\n statement =\> 'SELECT employee\_id, concat(concat(first\_name,' '), last\_name) "employee\_name", email, phone\_number, hire\_date, job\_id, salary, commission\_pct, manager\_id, department\_id FROM schema\_name.employees ORDER BY hire\_date ASC'\n\n\n ", :backtrace=\>["/data/elk/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in`each'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:166:in`block in converge\_state\_and\_update'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:164:in`converge\_state\_and\_update'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/data/elk/logstash-6.2.4/logstash-core/lib/logstash/runner.rb:348:in`block in execute'", "/data/elk/logstash-6.2.4/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

---

<div class="post-metadata">

**Author:** ![arkady\_renko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arkady_renko/32/30160_2.png) [@arkady\_renko](https://discuss.elastic.co/u/arkady_renko)\
**Post date:** [June 8, 2018, 6:07am UTC](https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004/4 "2018-06-08T06:07:50Z")

</div>

I suggest you to use double quotes instead of single quotes for sql statement and use **as** keyword to define new column. My test config is below.

`statement => "select description, concat(concat(username,' '),description) as new_col from ne_api_user"`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 8, 2018, 12:58pm UTC](https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004/5 "2018-06-08T12:58:11Z")

</div>

> [@Deepak\_Dandotiya](#):
>
> "Java::oracle.jdbc.driver.OracleDriver"\n\n statement =\> 'SELECT employee\_id, concat(concat(first\_name,' '), last\_name) "employee\_name", email, phone\_number, hire\_date, job\_id, salary, commission\_pct, manager\_id, department\_id FROM schema\_name.employees ORDER BY hire\_date ASC'\n\n\n "

Yeah, the problem is using (first\_name, ' ') with single quotes inside a statement that is delimited by single quotes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2018, 12:58pm UTC](https://discuss.elastic.co/t/concat-query-is-not-working-in-logstash/135004/6 "2018-07-06T12:58:20Z")

</div>

Closed on July 6, 2018, 12:58pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.