Logstash import two columns

Elastic Stack Logstash
#1

Hi
I use JDBC driver to connect Logstash with a data base and run a SP in statement.
the result of SP is one number(integer) and two columns.
I want to send these into one log in Elasticsearch

Could you please tell me how can I write the filter?
For example: I wrote this for the integer:

filter {
    mutate {
        add_field => {count => "%{untitled}"}
        convert => {count => integer}

What can I do for two columns?!?

#2

Hi Farid,

To better understand the question, you run a SP, and it gives you a total of 3 columns in a single event. One column is an integer and the other two columns are not an integer?

What happens if you index this event? How does it look in ES?

#3

Thank you NerdSec for your response.
No, actually the SP from data base returns 3things:
one number and two columns
I know how to filter my number(as I wrote before)
But I do not know how to filter and change the name of columns, or separate the values in one column. For example shall I do this?!?

filter {
    mutate {
        split => { "fieldname" => "," }
    }
}

All in all if I want to wrap everything up, I did not faced a column to index to Elasticsearch. I already import a log(just an integer number) via Logstash but I have not experience with how to import a column (or maybe a string) into elastcisearch

#4

I'm sorry, I couldn't quite understand the scenario.

Could you post some dummy data of how it looks in ES? And how do you want it? This would be a lot easier

#5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.