I am exploring my knowledge on configuring input plugins to my logstash. I have a docker container with elk running on it. I was successfully able to create metric beats and fetch logs from a REST API and create visualizations.
Next I am trying is inputting logs from an SQL server using JDBC input plugin for logstash. What I came across in several blogs to achieve this was to get the sqljdbc jar file and an input and output configuration for logstash which has details about connection string, user, password and query details.
input {
jdbc {
jdbc_driver_library => "c:/work/sqljdbc_6.4.0.0_enu.tar"
jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc_url => "jdbc:sqlserver://IPADDRESS:11.0.77.2;databasename=testdb"
jdbc_user => "root"
jdbc_password => "root"
statement => "select * from testdata"
schedule => "0 * * * *"
}
}
output {
elasticsearch {
protocol => http
index => "sqldata"
hosts => ["elasticsearch:9200"]
}
}
My initial struggle was how to push this configuration to logstash as my logstash is not separately in a container it is within the elk docker container. I found a command to do that which is mentioned as below, but after running that I am getting error which says host is unreachable for elasticsearch (error details mentioned below).
docker run --rm -v simple-out.conf:/usr/share/logstash/config docker.elastic.co/logstash/logstash:6.2.2
Error received after logstash runs:
[2018-04-11T08:30:39,953][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@elasticsearch:9200/, :path=>"/"} [2018-04-11T08:30:39,981][INFO ][logstash.licensechecker.licensereader] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://logstash_system:xxxxxx@elasticsearch:9200/, :path=>"/"} [2018-04-11T08:30:40,000][WARN ][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash_system:xxxxxx@elasticsearch:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@elasticsearch:9200/][Manticore::ResolutionFailure] elasticsearch"}
Is there anyone who can suggest me what am I missing/or doing incorrectly.