Logstash terminate if using sqlite plugin

Elastic Stack Logstash
1

Please let me question about sqlite plugin.

Logstash version: 1.5.4
OS: Windows Vista

I set logstash.conf as the below on input section after I ran "bin/plugin install logstash-input-sqlite".
But Logstash terminate immediately after execution.

---- @ logstash.conf ----
input {
sqlite {
path => "C:/Program Files/sample/test.db"
type => ACCESSLOG
}
}
....
---- @ logstash.conf ----

ACCESSLOG is table, which is in test.db.

Could you tell me workaround ?

Tyler

2

What do the LS logs show?

3

Hi Mark,

Thank you for your comment.

Logstash show the below logs.

----- @ logstash logs -----
io/console not supported; tty will not be manipulated
{:timestamp=>"2015-10-20T00:34:39.688000+0900", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: <LogStash::Inputs::Sqlite path=>"C:\\\\Program Files\\\\sample\\\\test", type=>"ACCESSLOG", debug=>false, codec=><LogStash::Codecs::Plain charset=>"UTF-8">, batch=>5>\n Error: Java::JavaSql::SQLException: [SQLITE_ERROR] SQL error or missing database (no such column: id)", :level=>:error}
{:timestamp=>"2015-10-20T00:34:41.779000+0900", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: <LogStash::Inputs::Sqlite path=>"C:\\\\Program Files\\\\sample\\\\test", type=>"ACCESSLOG", debug=>false, codec=><LogStash::Codecs::Plain charset=>"UTF-8">, batch=>5>\n Error: Java::JavaSql::SQLException: [SQLITE_ERROR] SQL error or missing database (no such column: id)", :level=>:error}
{:timestamp=>"2015-10-20T00:34:42.793000+0900", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: <LogStash::Inputs::Sqlite path=>"C:\\\\Program Files\\\\sample\\\\test", type=>"ACCESSLOG", debug=>false, codec=><LogStash::Codecs::Plain charset=>"UTF-8">, batch=>5>\n Error: Java::JavaSql::SQLException: [SQLITE_ERROR] SQL error or missing database (no such column: id)", :level=>:error}
----- @ logstash logs -----

4

That's your problem then.

5

Thank you for your comment !

I understand that the issue is caused by no id column from the LS log.
There is "id" although I confirmed table.
Could you tell me what cause the issue ?

sqliteviewer.jpg1053×667 72.8 KB

6

You should read the document.
https://www.elastic.co/guide/en/logstash/current/plugins-inputs-sqlite.html

All tables are read by default except:

If you don't read some tables, you should use "* exclude_tables*".