Sql_last_value as new field

[mwe]

Hi,
is it posible to use the value of sql_last_value in a new field ?

i use the following config:

input
{
jdbc
{
jdbc_driver_library => "/usr/local/lib/db2jcc4.jar,/usr/local/lib/db2jcc_license_cisuz.jar"
jdbc_driver_class => "com.ibm.db2.jcc.DB2Driver"
jdbc_connection_string => xxxxxxx
jdbc_user => xxxxxxxx
jdbc_password => xxxxxxx
statement => "SELECT ....., ........, .......... from .......... where ............. >:sql_last_value"
use_column_value => true
tracking_column => ...........
tracking_column_type => "timestamp"
schedule => "* * * * "
}
}
filter
{
mutate
{
replace => [ "message", "........." ]
gsub => [ 'message','\n','']
add_field => { "last_polling_time" => "%{sql_last_value}"}
remove_field => [ ".........." ]
}
if [message] =~ /^{.}$/
{
json {
source => message
}
}
}
output
{
elasticsearch {
........... }
}

i will get

..........
..........
"last_polling_time": "%{sql_last_value}",
.........
..........

in the Output.

regards
Michael

[Jenni]

I haven't tried it, but I think you could add the placeholder to the columns of your statement like this?
"SELECT :sql_last_value as last_polling_time, ...FROM ..."

(You are aware that this will contain the highest timestamp of your previous request, not the most recent one?)

[mwe]

Hi Jenni

thank you, great, works fine !

Yes i'm aware about it, but thx for the hint

regards
Michael