Oh yeah could of totally put this on the github page. So I ran this as such
./bin/logstash -f logstash-jdbc.conf &
And I keep checking the last_start time. Its the same time as previous. Never changes!
input {
jdbc {
jdbc_driver_library => "/logstash-1.5.0/ojdbc7.jar"
jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
jdbc_connection_string => "jdbc:oracle:thin:@//"
jdbc_user => ""
jdbc_password => ""
statement => "SELECT * from log where event_time > :sql_last_start"
record_last_run => true
last_run_metadata_path => "sincedbpath/.logstash_jdbc_last_run"
schedule => "* * * * *"
type => "log"
}
}
date {
locale => "en"
timezone => "America/New_York"
match => [
"event_time" , "YYYY-MM-dd HH:mm:ss.SSS"
]
}
output {
# stdout{ codec => rubydebug}
elasticsearch {
host => "localhost:9200"
}
}