Logstash output incorrect time value

Elastic Stack Logstash
1

Hi everyone,

I am try to use logstash 7.1.1 to get data from my sqlite3 db. I found an issue about the time. The time data was stored correctly in my database while it is not when using logstash.
For example, the time data is my db is
SELECT modified_at from table;

2019-06-13 13:33:09.325776

2019-06-12 20:57:17.207619

2019-06-12 20:58:18.758770

while the output shows:

"modified_at" => 2019-06-13T04:00:00.000Z,

"modified_at" => 2019-06-12T04:00:00.000Z,

"modified_at" => 2019-06-12T04:00:00.000Z,

the logstash only get the date not exact time. This is my config file:

input {
    jdbc {
        jdbc_driver_library => "mypath/sqlite-jdbc-3.27.2.1.jar"
        jdbc_driver_class => "org.sqlite.JDBC"
        jdbc_connection_string => "jdbc:sqlite:mypath/db.sqlite3"
        jdbc_user => ""
        tracking_column => "modified_at"
        tracking_column_type => "timestamp"
        use_column_value => true
        statement => "SELECT * from table where modified_at > :sql_last_value"
        schedule => "* * * * *"
        # clean_run => true
    }
}

filter {
  mutate {
    remove_field => ["@version","@timestamp","path","host"]
  }
}

output {
    elasticsearch {
        hosts => "localhost:9200"
        index => "test"
        document_type => "doc"
        document_id => "%{qid}"
    }
    stdout {
        codec => rubydebug
    }
}

And I also have a question about :sql_last_value.
If tracking a time column, :sql_last_value will return the latest time or earliest time or multi data?

Thank you!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.