# MariaDB audit

**URL:** <https://discuss.elastic.co/t/mariadb-audit/273934>\
**Category:** Logstash\
**Created:** [May 25, 2021, 12:47pm UTC](https://discuss.elastic.co/t/mariadb-audit/273934 "2021-05-25T12:47:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juju-fr34](https://avatars.discourse-cdn.com/v4/letter/j/9f8e36/32.png) [@Juju-fr34](https://discuss.elastic.co/u/Juju-fr34)\
**Post date:** [May 25, 2021, 12:47pm UTC](https://discuss.elastic.co/t/mariadb-audit/273934/1 "2021-05-25T12:47:28Z")

</div>

Hi everyone.

I'm trying to index my mariadb servers audit logs but I'm facing a problem. 90% off my logs are correctly indexed but some of them don't. It is like the produced csv is incorrect and message filed is empty.

Example of a malformed message :

`May 25 14:30:20 Logstash-01 logstash[25643]: [2021-05-25T14:30:20,883][WARN][logstash.filters.csv][main][35cad0b777b2f15697ee7b33dcadaeae58eba0d321aa516f34a9240ad5e2085] Error parsing csv {:field=>"message", :source=>" MariaDB-Divers.local;eai_form;10.10.10.10;22331;70880458;QUERY;formation_infocentreForm;\"DELETE FROM formation_infocentreForm.`par\_c\_echean\_projet`WHERE`numeroProjet` = \"234\"\";0", :exception=>#<CSV::MalformedCSVError: Missing or stray quote in line 1>}`

Her is my filter, partially created from informations of this topic : [[Logstash csv filter plugin, with mariadb audit plugin logs - #3 by fabrizio73](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953/3)]

```
 if [program] == "mysql-server_auditing" {
     mutate {
       add_field => { "log_type" => "Audit_DB" }
       add_field => { "[@metadata][target_index]" => "audit-mariadb-%{+YYYY.MM.DD}" }
       gsub => ["message", "(?<!\\)'", '"']
       gsub => ['message', ",", ";"]
     }

    csv {
        columns => ["serverhost", "username", "client_host", "connectionid", "queryid", "operation", "database", "object", "retcode"]
        separator => ";"
        convert => {
          "connectionid" => "integer"
          "queryid" => "integer"
          "retcode" => "integer"
        }
    }

```

Does someone have an idea of what is appening ?  
Does anybody have succesfully index mariaDB audit logs ?

Thanks for your help  
Juju

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 25, 2021, 2:26pm UTC](https://discuss.elastic.co/t/mariadb-audit/273934/2 "2021-05-25T14:26:42Z")

</div>

> [@Juju-fr34](#):
>
> ` MariaDB-Divers.local;eai_form;10.10.10.10;22331;70880458;QUERY;formation_infocentreForm;\"DELETE FROM formation_infocentreForm.` par\_c\_echean\_projet `WHERE` numeroProjet ` = \"234\"\";0`

OK, so you actual message contains

> MariaDB-Divers.local;eai\_form;10.10.10.10;22331;70880458;QUERY;formation\_infocentreForm;"DELETE FROM formation\_infocentreForm.`par_c_echean_projet`WHERE`numeroProjet` = "234"";0

In a CSV field any double quotes inside a field have to replaced with two double quotes. So if the actual field is

```
DELETE FROM ... `WHERE` numeroProjet ` = "234"

```

in a CSV file it would have to be

```
"DELETE FROM ... `WHERE` numeroProjet ` = ""234"""

```

What you have is not a valid CSV file, so ruby cannot parse it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2021, 2:26pm UTC](https://discuss.elastic.co/t/mariadb-audit/273934/3 "2021-06-22T14:26:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.