JDBC_STATIC_LOOKUP

Elastic Stack Logstash
1

2020-07-07T13:59:30,863][WARN ][logstash.filters.jdbc.lookup] Exception when executing Jdbc query {:lookup_id=>"lookup-1", :exception=>"Java::JavaSql::SQLSyntaxErrorException: Syntax error: Encountered ":" at line 1, column 46.", :backtrace=>["org.apache.derby.impl.jdbc.SQLExceptionFactory.getSQLException(org/apache/derby/impl/jdbc/SQLExceptionFactory)", "org.apache.derby.impl.jdbc.Util.generateCsSQLException(org/apache/derby/impl/jdbc/Util)", "org.apache.derby.impl.jdbc.TransactionResourceImpl.wrapInSQLException(org/apache/derby/impl/jdbc/TransactionResourceImpl)", "org.apache.derby.impl.jdbc.TransactionResourceImpl.handleException(org/apache/derby/impl/jdbc/TransactionResourceImpl)", "org.apache.derby.impl.jdbc.EmbedConnection.handleException(org/apache/derby/impl/jdbc/EmbedConnection)", "org.apache.derby.impl.jdbc.ConnectionChild.handleException(org/apache/derby/impl/jdbc/ConnectionChild)", "org.apache.derby.impl.jdbc.EmbedStatement.execute(org/apache/derby/impl/jdbc/EmbedStatement)", "org.apache.derby.impl.jdbc.EmbedStatement.executeQuery(org/apache/derby/impl/jdbc/EmbedStatement)"]

I have two lookup tables and two lookup queries both of them sometimes give this error and sometimes they give correct result what is the reason?

local_lookups => [
{
prepared_parameters => ["[memberidentifier]"]
query => "select * from usersClaim where alternateid = ?"
target => "jv_user_information"
},
{
prepared_parameters => ["[claimid]"]
query => "select * from claims where alternateid = ?"
target => "jv_claim_information"
}
]

2

Is it possible that the fields you are using for parameters do not exist on some events?

3

local_lookups => [
{
query => "select * from usersClaim where alternateid = :memberidentifier"
parameters => {memberidentifier => "[memberidentifier]"}
target => "jv_user_information"
},
{
query => "select * from claims where alternateid = :claimid"
parameters => {claimid => "[claimid]"}
target => "jv_claim_information"
}
]

I have changed query to this.But facing the same issue again.

4

These values are like primary keys they are present in the events.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.