Input jdbc to gelf output

Elastic Stack Logstash
1

Hello
I try to parse logs from my database to gelf using logstash, with my current configuration

input {
  jdbc {
    jdbc_driver_library => "/home/ubuntu/sqljdbc_6.0/enu/jre8/sqljdbc42.jar"
    jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
    jdbc_connection_string => "jdbc:sqlserver://server;databaseName=AdaptersDev;"
    jdbc_user => "Admin"
    jdbc_password => "*****"
    schedule => "* * * * *"
    type => "QueuedTasks"
    statement => "SELECT * from QueuedTasksLogs where QueueTimestamp > :sql_last_value"
  }
}

output {
  gelf {
    host => "172.17.34.75"
    port => "12201"
  }
}

I receive following errors:

13:02:04.228 [[main]>worker0] WARN logstash.outputs.gelf - Trouble sending GELF event {:gelf_event=>{"short_message"=>nil, "full_message"=>"%{message}", "host"=>"%{host}", "_datasourcetype"=>6, "_importdatatype"=>0, "_queuetimestamp"=>2017-04-18T11:42:38.000Z, "_tasktype"=>3, "_retrycount"=>0, "_interfacetype"=>0, "_retrytimestamp"=>2017-04-18T11:43:40.230Z, "_type"=>"QueuedTasks", "_messagedata"=>"{\r\n \"AccessToken\": \"P0+HScWeHbjbFPVqMuG4O3Mjor6i92VwNPUI4hJzf3eQ819FlapAAiRw41YeAj0Uyltf2fsy8O6KB7dTDI0ygal4MJNvH6J6\",\r\n \"IsFullUpload\": false,\r\n \"NumberOfRooms\": 0,\r\n \"Currency\": \"EUR\",\r\n \"Timezone\": \"GMT\"\r\n}", "_semaphoreid"=>"0FBB8883-F5B6-44FF-819A-98D67E130E48", "_tenantid"=>"41B2C1F6-84AE-4002-A9E0-92DF9ABA2CAC", "_machinename"=>"RD000D3A2202BF", "__id"=>"6FB398DE-4965-4C39-91C6-8B4783C21822", "_propertyid"=>"D202F70C-5111-4AE5-B0D1-C5FBAD0C44D2", "_createtype"=>0, "_status"=>3, "level"=>6}, :event=>2017-04-18T13:02:04.124Z %{host} %{message}, :error=>#<ArgumentError: short_message is missing. Options version, short_message and host must be set.>}

If I understand correctly, I should somehow map my messagedata to message field? I tried already with rename filter but that didn't worked as expected. Can someone help with my problem?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.