Filebeat mysql module does not work for mariadb logs?

[Kosodrom (Kosmodrom)]

Hi,

i have filebeat 7.16.2 installed with mysql module enabled to collect mariadb logs.

- module: mysql
  error:
    enabled: true
    var.paths: ["/home/user/var/log/*_error.log"]
  slowlog:
    enabled: true
    var.paths: ["/home/user/var/log/*-slow.log"]

I can confirm that the module is enabled:

[user]$ ./filebeat modules enable mysql 
Module mysql is already enabled

the logs are still not parsed correctly though (they are untouched at all). I still have everything in one message field:

"message": "2022-08-04 12:43:19 2217716 [Warning] Aborted connection 2217716 to db: 'db' user: 'user' host: 'localhost' (Got timeout reading communication packets)"

Does anyone have any ideas what I do wrong?

Thanks

[TiagoQueiroz]

Hi @Kosodrom,

Which version of MariaDB are you running? Do you see any errors on Filebeat or in the events on Elasticsearch/Kibana (look for an error key in the event).

The docs are pretty clear about the versions the module has been tested with:

The mysql module was tested with logs from MySQL 5.5, 5.7 and 8.0, MariaDB 10.1, 10.2 and 10.3, and Percona 5.7 and 8.0.

On Windows, the module was tested with MySQL installed from the Chocolatey repository.

If you still don't find the cause of the issue, then run Filebeat with log level debug and look the logs for more clues (or post them here). Just bear in mind that log level debug with all selectors enabled will log all events sent to Elasticsearch, hence they might have sensitive information.