Parsing field sql_bind into sql_text

Elastic Stack Logstash
1

I'm consuming oracle logs using logstash, i want to reconstruct the original sql statement that oracle(using variable binding) writes into two fields sql_bind and sql_text.

sql_text contains the sql sent to the database and sql_bind contains the parameters used in the query at run time.

Example:

sql_text=select * from hr.emp where empid = :empid and status = :status
sql_bind=#1(3):100 #2(2)99

This translates into:

select * from hr.emp where empid = 100 and status = 99

The thing is you don't know how many variables come at a given time. Is there any way for me to achieve what I need of reconstructing the original sql query?

Also, how could I parse the sql_bind field into one field for each variable given that the variable is the value after the ":".

2

I think you'll have to use a ruby filter for this, but the needed Ruby code shouldn't be very hard to write.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.