Logstash is modifying my SQL and causing it crash

This query runs fine in MS SQL management studio:

SELECT documents.*, FCCorgsstandardized.ein, FCCorgsstandardized.orgid, 
        FCCorgsstandardized.sourcestring, FCCorgsstandardized.cmteid, FCCorgsstandardized.uniqueid
        FROM documents 
        INNER JOIN station_states ON documents.station_id = station_states.station_id, FCCorgsstandardized
        WHERE (station_states.st = 'nm')

When I add it to my Logstash.conf config:

    jdbc {
        jdbc_connection_string => "jdbc:sqlserver://removed
:1433;databaseName=fcc"
        jdbc_user => "removed"
        jdbc_password => "removed"
        jdbc_driver_library => "/home/ubuntu/logstash-6.3.2/config/sqljdbc41.jar"
        jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
        statement => "SELECT documents.*, FCCorgsstandardized.ein, FCCorgsstandardized.orgid, 
        FCCorgsstandardized.sourcestring, FCCorgsstandardized.cmteid, FCCorgsstandardized.uniqueid
        FROM documents 
        INNER JOIN station_states ON documents.station_id = station_states.station_id, FCCorgsstandardized
        WHERE (station_states.st = 'nm')"

Logstash modifies it:

[2018-08-20T17:32:12,417][INFO ][logstash.inputs.jdbc     ] (0.692401s) SELECT TOP (1) count(*) AS [COUNT] FROM (SELECT documents.*, FCCorgsstandardized.ein, FCCorgsstandardized.orgid,
        FCCorgsstandardized.sourcestring, FCCorgsstandardized.cmteid, FCCorgsstandardized.uniqueid
        FROM documents
        INNER JOIN station_states ON documents.station_id = station_states.station_id, FCCorgsstandardized
        WHERE (station_states.st = 'nm')) AS [T1]

It's adding:
SELECT TOP (1) count(*) AS [COUNT] FROM

Which in turn causes an error:

[2018-08-20T17:32:12,453][WARN ][logstash.inputs.jdbc ] Exception when executing JDBC query {:exception=>#<Sequel::DatabaseError: Java::ComMicrosoftSqlserverJdbc::SQLServerException: Arithmetic overflow error converting expression to data type int.>}

Ideas? Why is it modifying my query?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.