Mssql jdbc

Elastic Stack Logstash
1

Hi,
i want push Data from MSQL into Elasticsearch.
In Logstash following Input file:

input {
jdbc {
jdbc_driver_library => "/etc/logstash/jdbc/mssql/sqljdbc_6.0/enu/jre8/sqljdbc42.jar"
jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc_connection_string => "jdbc:sqlserver://mssql23tc1:54836;databaseName=TestDB"
jdbc_user => "testdb"
jdbc_password => "testdb"
schedule => "* * * * *"
id => "mssql"
type => "mssql"
add_field => { "[fields][stage]" => "p" }
statement => "select * from sys.all_views"
}
}
creates index
logstash-p-V -2017.08.25, why i have "V " in the Index?
can someone help?

thanks
Roland

2

What does your elasticsearch output configuration look like?

3

Output config:

output {
elasticsearch {
hosts => [ "lxlog11p", "lxlog12p", "lxlog13p", "lxlog14p" ]
index => "logstash-%{[fields][stage]}-%{[type]}-%{+YYYY.MM.dd}"
user => "logstash"
password => "logstash01"
}
elasticsearch {
hosts => [ "lxlog21p", "lxlog22p", "lxlog23p", "lxlog24p" ]
index => "logstash-%{[fields][stage]}-%{[type]}-%{+YYYY.MM.dd}"
user => "logstash"
password => "logstash01"
}
}

4

It looks like your type field contains "V". What does an actual event that was stored in one of the indexes look like?

5

thanks you, that is the problem; i must look; Roland

Freundliche Grüße
Roland Plambeck

8506 IT-Datenbanksysteme / Speichertechnik
Provinzial Nord Brandkasse Aktiengesellschaft

Postanschrift: Sophienblatt 33, 24097 Kiel
Tel. +49 431 603-1844
Fax +49 431 603-101844
Mobil +49 173 5954034

Roland.Plambeck@provinzial.de

www.provinzial.de
Rund um die Uhr für Sie da: www.meineprovinzial.de

Provinzial Nord Brandkasse Aktiengesellschaft
Sophienblatt 33, 24097 Kiel, Amtsgericht Kiel HRB 5704
Vorstand: Dr. Wolfgang Breuer (Vorsitzender), Matthew Wilby (stv.
Vorsitzender), Frank Neuroth, Dr. Thomas Niemöller, Markus Reinhard,
Stefan Richter, Dr. Ulrich Scholten
Vorsitzender des Aufsichtsrats: Reinhard Boll

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.