Jdbc streaming renaming fields

Elastic Stack Logstash
1

I am using the jdbc streaming plugin and want to take the results and put them into new fields.
Below is the code that I am using

jdbc_streaming {
jdbc_driver_library => "C:\logstash-7.0.0\bin\sqljdbc42.jar"
jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc_connection_string => "jdbc:sqlserver://ltgsql.database.windows.net;databaseName=RHA;user=jgillman;password=%qkafn12=123;"
jdbc_user => "jgillman"
jdbc_password => "%qkafn12=123"
parameters => { "code" => "[agent][hostname]"}
statement => "select SiteName,Latitude,Longitude,HostedMachineName FROM Session_Key WHERE HostedMachineName like lower(:code)"
target => "site_data"
add_field => { "SiteName" => "[sitename]" }
}

I have also used
add_field => { "SiteName" => "[site_data][sitename]" }
add_field => { "SiteName" => "%{[site_data][sitename]}" }
mutate => {add_field => { "SiteName" => "%{[site_data][sitename]}" }}

and none of them work the output is

"site_data" : [
{
"latitude" : "this",
"hostedmachinename" : "rha-mgr-srv01",
"longitude" : "this",
"sitename" : "this"
}
],
"SiteName" : "[sitename]",

Not sure what I am doing wrong. Can anyone please help
thanks

2

site_data is an array. Does %{[site_data][0][sitename]} work?

3

Thank you so much that worked. I am still new to this so thanks for the quick response and help

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.