# Logstash writes SQL queries instead of logs **URL:** \ **Category:** Logstash\ **Created:** [July 2, 2019, 12:46pm UTC](https://discuss.elastic.co/t/logstash-writes-sql-queries-instead-of-logs/188515 "2019-07-02T12:46:11Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![MaxON](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@MaxON](https://discuss.elastic.co/u/MaxON)\ **Post date:** [July 2, 2019, 12:46pm UTC](https://discuss.elastic.co/t/logstash-writes-sql-queries-instead-of-logs/188515/1 "2019-07-02T12:46:12Z")
Hi everyone! Not long ago Logstash began writting very strange logs: ``` [2019-07-02T13:25:01,101][INFO][logstash.inputs.jdbc] (0.891000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T13:35:01,152][INFO][logstash.inputs.jdbc] (0.876000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T13:45:01,051][INFO][logstash.inputs.jdbc] (0.949000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T13:55:00,946][INFO][logstash.inputs.jdbc] (0.894000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T14:05:01,171][INFO][logstash.inputs.jdbc] (0.908000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T14:15:00,909][INFO][logstash.inputs.jdbc] (0.879000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T14:25:01,092][INFO][logstash.inputs.jdbc] (0.928000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T14:35:01,050][INFO][logstash.inputs.jdbc] (0.887000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T14:45:01,189][INFO][logstash.inputs.jdbc] (0.898000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T14:55:01,124][INFO][logstash.inputs.jdbc] (0.893000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T15:05:01,005][INFO][logstash.inputs.jdbc] (0.900000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T15:15:01,129][INFO][logstash.inputs.jdbc] (0.895000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T15:25:00,936][INFO][logstash.inputs.jdbc] (0.877000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) [2019-07-02T15:35:01,072][INFO][logstash.inputs.jdbc] (0.891000s) select id, FORMAT(datetimestamp,'yyyy-MM-ddTHH:mm:sszzz') as datetimestamp, eventlevel, source, message, details, username, addinfo from [rms].[dbo].[Event] (nolock) WHERE id = (select max(id) from [rms].[dbo].[Event]) ``` It looks like SQL queries and i think there should be the result of running these queries, not themselves. Help, please! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 2, 2019, 1:20pm UTC](https://discuss.elastic.co/t/logstash-writes-sql-queries-instead-of-logs/188515/2 "2019-07-02T13:20:31Z")
Does changing [sql\_log\_level](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-jdbc.html#plugins-inputs-jdbc-sql_log_level) help? ---
**Author:** ![MaxON](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@MaxON](https://discuss.elastic.co/u/MaxON)\ **Post date:** [July 2, 2019, 2:04pm UTC](https://discuss.elastic.co/t/logstash-writes-sql-queries-instead-of-logs/188515/3 "2019-07-02T14:04:22Z")
Sorry, maybe I didn't understand it right but it seems that You write about data for elasticsearch. But I mean logs of logstash itself. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 2, 2019, 2:11pm UTC](https://discuss.elastic.co/t/logstash-writes-sql-queries-instead-of-logs/188515/4 "2019-07-02T14:11:19Z")
No, I was referring to the configuration of the jdbc input in logstash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 30, 2019, 2:11pm UTC](https://discuss.elastic.co/t/logstash-writes-sql-queries-instead-of-logs/188515/5 "2019-07-30T14:11:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.