Jdbc_streaming - get clean target content - not the field name as well

[xmatt]

Hi there,

First post - I've spent a LONG time reading through the discuss posts and found as much as I can without posting my own question so THANKS for all the great info!!

My question is directly linked to the following topic:

Logstash filter jdbc_streaming: how to get the target value

Hello, I use jdbc_streaming filter to get data from an Oracle database and have something like this: filter { ... jdbc_streaming { jdbc_driver_library => "..." jdbc_driver_class => "..." jdbc_connection_string => "jdbc:oracle:thin:..." jdbc_user => "xxx" jdbc_password => "xxx" parameters => { "sql_par" => "my_id"} target => "sql_result" statement => "select 1234 sql_val from dual where :sql_par > -1000" } ... } I thought, the value 1234 could be directly assigned to an existing…

I expect that that will "expand" how discobot said it would so you'll be able to see that discussion.

My question about it is that I get the following in "discover" in Kibana:

    customer	     	  {
  "client_name": "Bob's IP at home"
}

It also has the following when I hover over the Exclamation mark "Objects in arrays are not well supported" in Kibana (I tried to tag this with both Logstash and Kibana, I couldn't so went with what I'm actually trying to solve, the jdbc_streaming in Logstash being clean). I don't have an array though, this is a single field from a table in a DB that I've pulled, a name to go with the IP address that I pulled out of the log stream and queried the DB for, so it can look nice and tidy in a dashboard.

I'm not too concerned about the "Objects in arrays are not well supported" error, although perhaps I should be cleaning that up somehow? help please?

That was a long intro I know... Real question starts below.

What I AM interested in though, and the title of the post reflects this, is getting the "target" out cleanly. As can be seen above, I get the name of the field in the table in the "Enriched Data" but I do NOT want that, I just want the information from that location, i.e. in this case "Bob's IP at home".

Thanks in advance everyone!!