Issue with CAST


I have an IP address in my database which I'm trying to extract and ingest into Elastic. I originally did a CAST on this statement (required as logstash did not like the source format).

input {
    jdbc {
        jdbc_connection_string => "jdbc:postgresql://"
        jdbc_user => "nexpose"
        jdbc_password => "mysecretpassword"
        jdbc_driver_class => "org.postgresql.Driver"
        jdbc_default_timezone => "America/Toronto"
        statement => "SELECT
        CAST(ip_address AS text),

And my IP addresses are appended with a /32 which is not what I want. I do not want the CIDR as these are always host IP addresses and not ever networks.

From playing around with CAST directly on the SQL server, I need to do a CAST(ip_address AS inet), however, this does not appear to be supported on logstash.... error below....

[WARN ] 2020-04-21 13:12:22.417 [[main]<jdbc] jdbc - Exception when executing JDBC query {:exception=>#<Sequel::DatabaseError: Java::OrgLogstash::MissingConverterException: Missing Converter handling for full class name=org.postgresql.util.PGobject, simple name=PGobject>

Any suggestions on how I can parse this without the CIDR?


I left it as text and added a gsub filter to remove the /32 which works. Just wondering if this is the best option?

  mutate {
    gsub => [
      "ip_address", "/32", ""

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.