Logstash pulls all records from postgres db not as per join


(RAMESH) #1

Here is my logstash.conf file

input {
jdbc {
# Postgres jdbc connection string to our database, nnm
jdbc_connection_string => "jdbc:postgresql://localhost:5432/nnm"
# The user we wish to execute our statement as
jdbc_user => "postgres"
jdbc_password => "password"
jdbc_validate_connection => true
# The path to our downloaded jdbc driver
jdbc_driver_library => "/opt/OV/nmsas/server/nms/lib/postgresql.jar"
# The name of the driver class for Postgresql
jdbc_driver_class => "org.postgresql.Driver"
schedule => "45 * * * * *"
# our query
statement => "select distinct nms_node.name,nms_node_stat.cur_stat,nms_node_cna.parent from nms_node inner join nms_node_stat on nms_node_stat.id=nms_node.id inner join nms_node_cna on nms_node_cna.parent=nms_node.id where nms_node_cna.value like 'ITSEC'"
}
}
output {
elasticsearch {
hosts => "localhost:9200"
index => "itsec"
document_type => "itsecstatus"
document_id => "%{parent}"
}
stdout { codec => rubydebug }
}

However when I check output of itsec index, I see all records are been pulled by logstash jdbc plugin.

If I run sql statement in Postgres it pulls only two records.

Please advise.