Logstash conf

Elastic Stack Logstash
1

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 8, column 97 (byte 388) after input {\n jdbc {\n jdbc_driver_library => "/home/elkadmin/Desktop/spdatabase/jdbc.jar"\n jdbc_driver_class => "com.mysql.jdbc.Driver"\n jdbc_connection_string => "jdbc:mysql://localhost:3306/identityiq?zeroDateTimeBehavior=convertToNull"\n jdbc_user =>"root"\n jdbc_password => ""\n statement => "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key="", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in block in converge_state'"]}
[2020-04-21T11:42:56,632][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-04-21T11:43:01,132][INFO ][logstash.runner ] Logstash shut down.

2

Are you asking for help here?

3

Yeah. Anything wrong with the syntax?

4

If you have double quotes in the value of @key they need to be escaped. What does the statement option look like in your configuration?

5

Here is the statement I've written in the logfile:

statement => "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key="CITY"]/@value')) as Regions from spt_identity"

When I executed this query in phpmyadmin it was working fine. But while creating an index it is showing the error mentioned above.

6

You need to escape the double quotes withing the statement.

statement => "select concat('CITY = ',ExtractValue(attributes, '/Attributes/Map/entry[@key=\"CITY\"]/@value')) as Regions from spt_identity"
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.