Packetbeat & MySQL


I'm running an Ubuntu 14.04 machine in Vagrant / Virtualbox, i spinned up a scotchbox, acting as a LAMP server.
Packetbeat 1.2.3 is sending data directly to Elasticsearch.
Elasticsearch is successfully receiving data from the server. So connection-wise everything is good. The bind-address of MySQL is set to

Data is inserted into a MySQL database named 'test1' via a php script. But this traffic is not shown in Kibana.
How can I view the impact of the performance in Kibana of that data being inserted?

  1. with virtual machines always check time being in sync.
  2. have you tried plain mysql command line tool (make sure you connect via tcp, not unix socket) and do a SELECT 1; ?
  3. is your script using prepared-statements? These are currently not supported by the protocol analyzer.

Check, time is indeed correct.


mysql -h -u root -p 

See this image: Imgur: The magic of the Internet

It's a very, very simple php code that POST"s three variables into the Database. For convience:

[code]$first_name = mysqli_real_escape_string($link, $_POST['firstname']);
$last_name = mysqli_real_escape_string($link, $_POST['lastname']);
$email_address = mysqli_real_escape_string($link, $_POST['email']);

$sql = "INSERT INTO persons (first_name, last_name, email_address) VALUES ('$first_name', '$last_name', '$email_address')";
echo "Records added successfully.";
} [/code]

So three variables are posted into the database. Should packetbeat send the metrics of the performance to Elasticsearch?

Is php script connecting to database via unix socket?

I'm guessing it is...

mysqli_connect("", "root", "steffens", "scotchbox");

have you checked with netstat? Have you tried to capture a raw trace using tcpdump and check in wireshark traffic is send unencrypted on interface being monitored?

While inserting data into the database I performed

 packetbeat -e -dump trace.pcap 

I have no idea why, but the data is now shown in Kibana...
Thanks for the help!

This topic was automatically closed after 21 days. New replies are no longer allowed.