Logstash writes SQL queries instead of logs

Elastic Stack Logstash
1

Hi everyone! Not long ago Logstash began writting very strange logs:

[2019-07-02T13:25:01,101][INFO ][logstash.inputs.jdbc     ] (0.891000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T13:35:01,152][INFO ][logstash.inputs.jdbc     ] (0.876000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T13:45:01,051][INFO ][logstash.inputs.jdbc     ] (0.949000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T13:55:00,946][INFO ][logstash.inputs.jdbc     ] (0.894000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T14:05:01,171][INFO ][logstash.inputs.jdbc     ] (0.908000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T14:15:00,909][INFO ][logstash.inputs.jdbc     ] (0.879000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T14:25:01,092][INFO ][logstash.inputs.jdbc     ] (0.928000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T14:35:01,050][INFO ][logstash.inputs.jdbc     ] (0.887000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T14:45:01,189][INFO ][logstash.inputs.jdbc     ] (0.898000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T14:55:01,124][INFO ][logstash.inputs.jdbc     ] (0.893000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T15:05:01,005][INFO ][logstash.inputs.jdbc     ] (0.900000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T15:15:01,129][INFO ][logstash.inputs.jdbc     ] (0.895000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T15:25:00,936][INFO ][logstash.inputs.jdbc     ] (0.877000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])
[2019-07-02T15:35:01,072][INFO ][logstash.inputs.jdbc     ] (0.891000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event])

It looks like SQL queries and i think there should be the result of running these queries, not themselves. Help, please!

2

Does changing sql_log_level help?

3

Sorry, maybe I didn't understand it right but it seems that You write about data for elasticsearch. But I mean logs of logstash itself.

4

No, I was referring to the configuration of the jdbc input in logstash.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.