# Logstash filter jdbc\_streaming: how to get the target value

**URL:** https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959
**Category:** Logstash
**Created:** [October 6, 2017, 7:19am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959 "2017-10-06T07:19:30Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ras\_dvt](https://avatars.discourse-cdn.com/v4/letter/r/7cd45c/32.png) [@ras\_dvt](https://discuss.elastic.co/u/ras_dvt)
#### Post date: [October 6, 2017, 7:19am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959/1 "2017-10-06T07:19:30Z")

</div>

Hello,  
I use jdbc\_streaming filter to get data from an Oracle database  
and have something like this:

filter {  
...  
jdbc\_streaming  
{  
jdbc\_driver\_library =\> "..."  
jdbc\_driver\_class =\> "..."  
jdbc\_connection\_string =\> "jdbc:oracle:thin:..."  
jdbc\_user =\> "xxx"  
jdbc\_password =\> "xxx"  
parameters =\> { "sql\_par" =\> "my\_id"}  
target =\> "sql\_result"  
statement =\> "select 1234 sql\_val from dual where :sql\_par \> -1000"  
}  
...  
}

I thought, the value 1234 could be directly assigned to an existing field of the event.  
But I did not find the correct syntax yet.  
Using existing numeric or string fields in the "target =\>" option, I got conversion errors.  
So I used a new field "sql\_result" and can see in a json output:

"sql\_result" =\> [  
[0] {  
"sql\_val" =\> 1234.0  
}  
],

So it looks for me like an array with one object!?  
In the kibana index pattern menu, I see a number field "sql\_result.sql\_val".  
In the kibana discover menu, I see:  
sql\_result:{ "sql\_val": 1234 } # a single object!?

What is the correct syntax for a ruby (with "event.set" and "event.get") or a mutate filter  
(with "existing\_field" =\> "%{[xxxx]]}" or similar) to catch the value 1234 from "sql\_result".

Thanks in advance  
Roland

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [October 6, 2017, 9:54am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959/2 "2017-10-06T09:54:31Z")

</div>

If I understand correctly, you want to extract the number into a field.

try a mutate update with `{"[sql_result]" => "%{[sql_result][0][sql_val]}"}`

---

<div class="post-metadata">

### Author: ![ras\_dvt](https://avatars.discourse-cdn.com/v4/letter/r/7cd45c/32.png) [@ras\_dvt](https://discuss.elastic.co/u/ras_dvt)
#### Post date: [October 6, 2017, 10:19am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959/3 "2017-10-06T10:19:08Z")

</div>

That is exactly, what I wished to have! Thanks very much!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 3, 2017, 10:19am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-how-to-get-the-target-value/102959/4 "2017-11-03T10:19:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.