# Logstash input jdbc :unknown error: **URL:** \ **Category:** Logstash\ **Created:** [June 5, 2018, 5:47pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-unknown-error/134671 "2018-06-05T17:47:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Olatunde\_Tokun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olatunde_tokun/32/22312_2.png) [@Olatunde\_Tokun](https://discuss.elastic.co/u/Olatunde_Tokun)\ **Post date:** [June 5, 2018, 5:47pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-unknown-error/134671/1 "2018-06-05T17:47:09Z")
Hey, I use multi pipeline to ingest logs from a database using jdbc driver. It works great, but every once (once in 2 hours) in a while I see errors from the jdbc input plugin. There are no missing events because it uses a timebased sql\_last\_value, but im curious to know why there are these errors and how it can be resolved. ``` [2018-06-05T12:34:02,702][ERROR][logstash.inputs.jdbc] Java::JavaSql::SQLException: unknown error: SELECT client_application_id, client_application_name, FROM_UNIXTIME(connection_sec), HEX(dst_ipaddr) as dst, dst_port, event_id, FROM_UNIXTIME(event_time_sec) as rt, impact, interface_egress_name, interface_ingress_name, protocol_name, protocol_num, priority, rule_classification, rule_classification_id, rule_message as name, rule_signature_id, rule_generator_id, security_zone_egress_name, security_zone_ingress_name, sensor_name, sensor_address, HEX(src_ipaddr) as src, src_port, src_user_name, vlan_id FROM table WHERE FROM_UNIXTIME(connection_sec)>'2018-06-05 16:33:01.814906' ``` The input config file is below: input { jdbc { jdbc\_connection\_string =\> "jdbc:vjdbc:rmi://server:port/VJdbc,eqe" jdbc\_validate\_connection =\> false jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/vjdbc.jar,/usr/share/logstash/logstash-core/lib/jars/commons-logging-1.1.jar" jdbc\_driver\_class =\> "com.technology.vjdbc.VirtualDriver" jdbc\_default\_timezone =\> "Etc/UTC" schedule =\> "\* \* \* \* \*" clean\_run =\> false last\_run\_metadata\_path =\> "/usr/share/logstash/config/.lastrun\_intrusion" add\_field =\> { "source" =\> "tablename" } tracking\_column\_type =\> "timestamp" statement =\> "SELECT client\_application\_id, client\_application\_name, FROM\_UNIXTIME(connection\_sec), HEX(dst\_ipaddr) as dst, dst\_port, event\_id, FROM\_UNIXTIME(event\_time\_sec) as rt, impact, interface\_egress\_name, interface\_ingress\_name, protocol\_name, protocol\_num, priority, rule\_classification, rule\_classification\_id, rule\_message as name, rule\_signature\_id, rule\_generator\_id, security\_zone\_egress\_name, security\_zone\_ingress\_name, sensor\_name, sensor\_address, HEX(src\_ipaddr) as src, src\_port, src\_user\_name, vlan\_id FROM table WHERE FROM\_UNIXTIME(connection\_sec)\>:sql\_last\_value" } } Thanks in advance. ---
**Author:** ![Olatunde\_Tokun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olatunde_tokun/32/22312_2.png) [@Olatunde\_Tokun](https://discuss.elastic.co/u/Olatunde_Tokun)\ **Post date:** [June 5, 2018, 8:06pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-unknown-error/134671/2 "2018-06-05T20:06:33Z")
Below is running LS in debug mode. Though not sure how Im supposed to fix this. Is this happening because LS is trying to count the amount of rows to be added? Any ideas or pointers would be appreciated. [DEBUG MODE] [2018-06-05T15:59:02,781][ERROR][logstash.inputs.jdbc] Java::JavaSql::SQLException: parse error: unexpected keyword [SELECT]: SELECT count(\*) AS "COUNT" FROM (SELECT application\_name, client\_application\_id, client\_application\_name, FROM\_UNIXTIME(connection\_sec), detection\_name, detector\_type, direction, disposition, domain\_name, HEX(dst\_ipaddr) as dst, dst\_port, event\_description, event\_id, event\_type, file\_name, file\_path, file\_sha, file\_size, file\_timestamp, file\_type, http\_response\_code,score/100 as severity, sensor\_name as dvchost, HEX(src\_ipaddr) as src, src\_port, threat\_name, timestamp as rt, url, username FROM table1 WHERE FROM\_UNIXTIME(connection\_sec)\>'2018-06-05 19:48:01.625947') AS "T1" LIMIT 1 [2018-06-05T15:59:02,795][WARN][logstash.inputs.jdbc] Exception when executing JDBC query {:exception=\>#\} [2018-06-05T15:59:02,987][ERROR][logstash.inputs.jdbc] Java::JavaSql::SQLException: parse error: unexpected keyword [SELECT]: SELECT count(\*) AS "COUNT" FROM (SELECT action, application\_id, application\_name, FROM\_UNIXTIME(connection\_sec), client\_application\_name, direction, disposition, domain\_name, HEX(dst\_ipaddr) as dst, dst\_port, event\_description, file\_name, file\_sha, file\_size, file\_type, file\_type\_id, file\_type\_category, http\_response\_code, sensor\_id, sandboxed, score/10 as severity, HEX(src\_ipaddr) as src, src\_port, sensor\_address as dvc, sensor\_name, threat\_name, policy\_uuid, url, username, user\_id FROM table2 WHERE FROM\_UNIXTIME(connection\_sec)\>'2018-06-05 19:48:01.642526') AS "T1" LIMIT 1 [2018-06-05T15:59:02,992][ERROR][logstash.inputs.jdbc] Java::JavaSql::SQLException: parse error: unexpected keyword [SELECT]: SELECT count(\*) AS "COUNT" FROM (SELECT access\_control\_policy\_name, access\_control\_rule\_name, application\_protocol\_name, blocked, client\_application\_id, client\_application\_name, FROM\_UNIXTIME(connection\_sec), HEX(dst\_ipaddr) as dst, dst\_port, event\_id, FROM\_UNIXTIME(event\_time\_sec) as rt, impact, interface\_egress\_name, interface\_ingress\_name, protocol\_name, protocol\_num, priority, rule\_classification, rule\_classification\_id, rule\_message as name, rule\_signature\_id, rule\_generator\_id, security\_zone\_egress\_name, security\_zone\_ingress\_name, sensor\_name, sensor\_address, HEX(src\_ipaddr) as src, src\_port, src\_user\_name, vlan\_id FROM table3 WHERE FROM\_UNIXTIME(connection\_sec)\>'2018-06-05 19:48:01.580091') AS "T1" LIMIT 1 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 3, 2018, 8:06pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-unknown-error/134671/3 "2018-07-03T20:06:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.