Logstash - Keep it running

Elastic Stack Logstash
1

I have created environment where logstash is taking data from MS SQL server and feeding (output ) it to Elastic. Main reason to use logstash is to keep these both DB in sync. But now as soon as it feeds data into elastic, pipeline gets terminated.

[2018-04-25T13:13:14,338][INFO ][logstash.pipeline ] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#<Thread:0x5d90da37 run>"}

  1. Do i need any config changes in order to keep logstash always running?
  2. How does logstash detects changes in MS-SQL for updating it into Elastic?
2

You have to define a schedule to make LogStash query the database regularly and use the :sql_last_value to query only the new/changed entries, e.g.:

statement => "SELECT * FROM my_table WHERE modified >= :sql_last_value"
use_column_value => true
tracking_column => "modified"
tracking_column_type => "timestamp"

Have a look at the JDBC input documentation.

3

Thanks Jenni