Parsing field sql_bind into sql_text

I'm consuming oracle logs using logstash, i want to reconstruct the original sql statement that oracle(using variable binding) writes into two fields sql_bind and sql_text.

sql_text contains the sql sent to the database and sql_bind contains the parameters used in the query at run time.

Example:

sql_text=select * from hr.emp where empid = :empid and status = :status
sql_bind=#1(3):100 #2(2)99

This translates into:

select * from hr.emp where empid = 100 and status = 99

The thing is you don't know how many variables come at a given time. Is there any way for me to achieve what I need of reconstructing the original sql query?

Also, how could I parse the sql_bind field into one field for each variable given that the variable is the value after the ":".

I think you'll have to use a ruby filter for this, but the needed Ruby code shouldn't be very hard to write.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.