Query OK in JDBC_Stream But Not In JDBC_Static?

Elastic Stack Logstash
1

Hey, I have a query which works fine while using the JDBC steam "statement" but it does not seem to work while using JDBC static.
Here's my JDBC_Stream configuration:

filter {
  jdbc_streaming {
    jdbc_driver_class => "com.mysql.cj.jdbc.Driver"
    jdbc_connection_string => "jdbc:mysql://<address>:<port>/<db>"
    jdbc_user => "user"
    jdbc_password => "password"
    statement => "SELECT name FROM db_table WHERE inet_aton(?) between ip_from_int and ip_to_int limit 1"
    use_prepared_statements => true
    prepared_statement_name => "the_info"
    prepared_statement_bind_values => ["[clientip]"]
    target => "result"

    add_field => { isp_name => "%{[result][0][name]}" }
    remove_field => ["result"]
  }
}

And here's my JDBC_Static configuration:

filter {
  jdbc_static {
    loaders => [
      {
        id => "my_table"
        query => "select ip_from_int, ip_to_int, name from ip_ranges"
        local_table => "my_table"
       }
    ]
    local_db_objects => [
      {
        name => "my_table"
        columns => [
          ["ip_from_int", "INT(10)"],
          ["ip_to_int", "INT(10)"],
          ["name", "VARCHAR(255)"]
        ]
      }
    ]
    local_lookups => [
      {
        query => "SELECT name FROM db_table WHERE inet_aton(?) between ip_from_int and ip_to_int limit 1"
        prepared_parameters => ["[clientip]"]
        target => "result"
      }
    ]
    add_field => { result_name => "%{[result][0][name]}" }
    remove_field => ["result"]

    loader_schedule => "0 */2 * * *"
    jdbc_user => "user"
    jdbc_password => "password"
    jdbc_driver_class => "com.mysql.cj.jdbc.Driver"
    jdbc_connection_string => "jdbc:mysql://<address>:<port>/<db>"
    staging_directory => "/var/logstash/jdbc_static/import_data/"
  }
 }

I'd be glad if anyone could help!

2

A jdbc_streaming filter executes a query against a database using JDBC. So the query can use anything that that database (MySQL) supports.

A jdbc_static filter builds a Derby in-memory database from the results of the loaders. You might be able to use inet_aton in the loader, but Derby does not support it, so you cannot use it in the query.

1 Like
3

Thanks; I was not aware of that. Is there a solution to be able to use inet_aton()? Something similar?

4

I cannot think of a way to do that in a jdbc_static filter.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.