Packebeat 7.1 mysql select duration

I use beats 7.1 to minitor mysql, when the method is select, we found the event not have the duration, and that the start and end is reverse.

    "@timestamp":"2019-11-06T04:40:21.168Z",
    "@metadata":{
        "beat":"packetbeat",
        "type":"_doc",
        "version":"7.1.0"
    },
    "status":"OK",
    "event":{
        "dataset":"mysql",
        "start":"2019-11-06T04:40:21.168Z", //start
        "end":"2019-11-06T04:40:21.167Z", //end is reverse
        "kind":"event",
        "category":"network_traffic"
    },
    "destination":{
        "bytes":3245,
        "ip":"192.168.1.17",
        "port":3306
    },
    "ecs":{
        "version":"1.0.0"
    },
    "query":"select server.containerName containerName, server.status status,bd1.code system,bd2.code subSystem from (dbaasContainer server inner join basicData bd1 on server.businessSystemId=bd1.id) inner join basicData bd2 on server.subBusinessSystemId=bd2.id",
    "server":{
        "port":3306,
        "bytes":3245,
        "ip":"192.168.1.17"
    },
    "method":"SELECT",
    "client":{
        "ip":"192.168.1.31",
        "port":49646,
        "bytes":253
    },
    "network":{
        "bytes":3498,
        "type":"ipv4",
        "transport":"tcp",
        "protocol":"mysql",
        "direction":"inbound",
        "community_id":"1:GIPf9ADPszdhVKg1wJH/vTKP8LQ="
    },
    "fields":{
        "TOPICS__":"upsql",
        "ip":"192.168.1.17"
    },
    "mysql":{
        "num_rows":41,
        "num_fields":20,
        "affected_rows":0,
        "insert_id":0
    },
    "type":"mysql",
    "path":"., utf8.utf8",
    "source":{
        "bytes":253,
        "ip":"192.168.1.31",
        "port":49646
    },
    "host":{
        "name":"host17"
    },
    "agent":{
        "type":"packetbeat",
        "ephemeral_id":"0fb8006c-1b89-4bc4-8c6b-065a44b83389",
        "hostname":"host17",
        "id":"c1c9594d-b766-451e-901c-1090872b750d",
        "version":"7.1.0"
    }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.