# Logstash is modifying my SQL and causing it crash

**URL:** https://discuss.elastic.co/t/logstash-is-modifying-my-sql-and-causing-it-crash/145215
**Category:** Logstash
**Created:** [August 20, 2018, 5:39pm UTC](https://discuss.elastic.co/t/logstash-is-modifying-my-sql-and-causing-it-crash/145215 "2018-08-20T17:39:36Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![nomoneynoproblems](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nomoneynoproblems/32/44524_2.png) [@nomoneynoproblems](https://discuss.elastic.co/u/nomoneynoproblems)
#### Post date: [August 20, 2018, 5:39pm UTC](https://discuss.elastic.co/t/logstash-is-modifying-my-sql-and-causing-it-crash/145215/1 "2018-08-20T17:39:36Z")

</div>

This query runs fine in MS SQL management studio:

```
SELECT documents.*, FCCorgsstandardized.ein, FCCorgsstandardized.orgid, 
        FCCorgsstandardized.sourcestring, FCCorgsstandardized.cmteid, FCCorgsstandardized.uniqueid
        FROM documents 
        INNER JOIN station_states ON documents.station_id = station_states.station_id, FCCorgsstandardized
        WHERE (station_states.st = 'nm')

```

When I add it to my Logstash.conf config:

```
    jdbc {
        jdbc_connection_string => "jdbc:sqlserver://removed
:1433;databaseName=fcc"
        jdbc_user => "removed"
        jdbc_password => "removed"
        jdbc_driver_library => "/home/ubuntu/logstash-6.3.2/config/sqljdbc41.jar"
        jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
        statement => "SELECT documents.*, FCCorgsstandardized.ein, FCCorgsstandardized.orgid, 
        FCCorgsstandardized.sourcestring, FCCorgsstandardized.cmteid, FCCorgsstandardized.uniqueid
        FROM documents 
        INNER JOIN station_states ON documents.station_id = station_states.station_id, FCCorgsstandardized
        WHERE (station_states.st = 'nm')"

```

Logstash modifies it:

```
[2018-08-20T17:32:12,417][INFO][logstash.inputs.jdbc] (0.692401s) SELECT TOP (1) count(*) AS [COUNT] FROM (SELECT documents.*, FCCorgsstandardized.ein, FCCorgsstandardized.orgid,
        FCCorgsstandardized.sourcestring, FCCorgsstandardized.cmteid, FCCorgsstandardized.uniqueid
        FROM documents
        INNER JOIN station_states ON documents.station_id = station_states.station_id, FCCorgsstandardized
        WHERE (station_states.st = 'nm')) AS [T1]

```

It's adding:  
`SELECT TOP (1) count(*) AS [COUNT] FROM`

Which in turn causes an error:

`[2018-08-20T17:32:12,453][WARN][logstash.inputs.jdbc] Exception when executing JDBC query {:exception=>#<Sequel::DatabaseError: Java::ComMicrosoftSqlserverJdbc::SQLServerException: Arithmetic overflow error converting expression to data type int.>}`

Ideas? Why is it modifying my query?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2018, 5:39pm UTC](https://discuss.elastic.co/t/logstash-is-modifying-my-sql-and-causing-it-crash/145215/2 "2018-09-17T17:39:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.