# Sending data using JDBC input **URL:** \ **Category:** Logstash\ **Created:** [August 30, 2016, 4:42pm UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341 "2016-08-30T16:42:45Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ramongo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramongo/32/11688_2.png) [@ramongo](https://discuss.elastic.co/u/ramongo)\ **Post date:** [August 30, 2016, 4:42pm UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/1 "2016-08-30T16:42:45Z")
Hi Specialists! I'm trying to send data from an JDBC input (SQLServer 2008) to a SYSLOG Server, I don't want the column names...just the result set in line mode. When I specify this , the output is shown in the following way: ogtrust@relayInhouse-psql:~/logstash$ ./bin/logstash -f sqlserver\_logstash.conf !!! Please upgrade your java version, the current version '1.7.0\_25-b15' may cause problems. We recommend a minimum version of 1.7.0\_51 Settings: Default pipeline workers: 1 Pipeline main started 2016-08-25T23:04:00.414Z %{host} %{message} 2016-08-25T23:04:00.417Z %{host} %{message} 2016-08-25T23:04:00.418Z %{host} %{message} but when I put json,json\_lines or rubydebug I have the correct output with the field names (I just want the data like an SQL query): { "autoid" =\> 207459905, "autoguid" =\> "RRSSDF-2AC1-4659-9943-A984BBFECCC1", "serverid" =\> "AAPSOS2", "detectedutc" =\> "2015-05-05T23:53:25.000Z", "sourceip" =\> 0, "targetip" =\> 0, "targetusername" =\> "D\_ANOTA\\jriusb", "targetfilename" =\> "C:\\Users\\jriusb\\AppData\\Local\\MICROSOFT\\Windows\\TEMPORARY INTERNET FILES\\desktop.ini", "sourcehostname" =\> "\_", "targethostname" =\> "ALAVERGA", "threatcategory" =\> "hip.file", "threateventid" =\> 1095, "threatseverity" =\> 5, "threatname" =\> Protect me please", "threatactiontaken" =\> "would deny read", "threathandled" =\> false, "@version" =\> "1", "@timestamp" =\> "2016-08-25T23:07:00.227Z" } The .conf is : input { jdbc { jdbc\_driver\_library =\> "/home/conf/sqljdbc\_4.2/enu/sqljdbc41.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_connection\_string =\> "deleted" jdbc\_user =\> "sa" jdbc\_password =\> "" schedule =\> "\* \* \* \* \*" tracking\_column =\> AutoID statement =\> "select AutoID,AutoGUID,ServerID,DetectedUTC,SourceIPV4 as SourceIP,TargetIPV4 as TargetIP,TargetUserName,TargetFileName,SourceHostName,TargetHostName,ThreatCategory,ThreatEventID,ThreatSeverity,ThreatName,ThreatActionTaken,ThreatHandled from ePO\_WIN.dbo.EPOEventsMT;" } } output { stdout { codec =\> rubydebug } } Thanks in advance!!! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 30, 2016, 5:48pm UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/2 "2016-08-30T17:48:25Z")
Perhaps you're looking for the csv output? The default line codec (resulting in "2016-08-25T23:04:00.414Z %{host} %{message}") doesn't include all field values. You can change the format used but then you have to explicitly list the names of the fields you want. ---
**Author:** ![ramongo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramongo/32/11688_2.png) [@ramongo](https://discuss.elastic.co/u/ramongo)\ **Post date:** [August 31, 2016, 8:27am UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/3 "2016-08-31T08:27:23Z")
Thanks Magnus for the answer! I don't want csv output , I need just the raw output (like the codec =\> lines). Could you please tell me how to change the format ? when I put %{message} the output displays %{message} and not the query output. Thanks in advance ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 31, 2016, 10:25am UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/4 "2016-08-31T10:25:34Z")
But there isn't any "raw" output. What would that even mean in this case? > when I put %{message} the output displays %{message} and not the query output. Yes, because the jdbc input doesn't produce any `message` field. ---
**Author:** ![ramongo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramongo/32/11688_2.png) [@ramongo](https://discuss.elastic.co/u/ramongo)\ **Post date:** [September 5, 2016, 1:06pm UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/5 "2016-09-05T13:06:04Z")
By raw I mean just the values of the fields... But if jdbc doesn't produce any message field then what is created? How can I manipulate the result set? Thanks! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 5, 2016, 1:25pm UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/6 "2016-09-05T13:25:31Z")
The jdbc input creates one field for each column in each row of the result set. Logstash has various filters for manipulating field values. If you use a `stdout { codec => rubydebug }` output you'll see exactly what you get. ---
**Author:** ![ramongo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramongo/32/11688_2.png) [@ramongo](https://discuss.elastic.co/u/ramongo)\ **Post date:** [September 6, 2016, 2:19pm UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/7 "2016-09-06T14:19:44Z")
Thanks Magnus! I could access the parameters! Best Regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/sending-data-using-jdbc-input/59341/8 "2017-07-06T04:39:37Z")