# Sql\_last\_value as new field

**URL:** <https://discuss.elastic.co/t/sql-last-value-as-new-field/153143>\
**Category:** Logstash\
**Created:** [October 19, 2018, 8:39am UTC](https://discuss.elastic.co/t/sql-last-value-as-new-field/153143 "2018-10-19T08:39:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mwe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mwe/32/36703_2.png) [@mwe](https://discuss.elastic.co/u/mwe)\
**Post date:** [October 19, 2018, 8:39am UTC](https://discuss.elastic.co/t/sql-last-value-as-new-field/153143/1 "2018-10-19T08:39:19Z")

</div>

Hi,  
is it posible to use the value of sql\_last\_value in a new field ?

i use the following config:

> input  
> {  
> jdbc  
> {  
> jdbc\_driver\_library =\> "/usr/local/lib/db2jcc4.jar,/usr/local/lib/db2jcc\_license\_cisuz.jar"  
> jdbc\_driver\_class =\> "com.ibm.db2.jcc.DB2Driver"  
> jdbc\_connection\_string =\> xxxxxxx  
> jdbc\_user =\> xxxxxxxx  
> jdbc\_password =\> xxxxxxx  
> statement =\> "SELECT ....., ........, .......... from .......... where ............. **\>:sql\_last\_value"**  
> use\_column\_value =\> true  
> tracking\_column =\> ...........  
> tracking\_column\_type =\> "timestamp"  
> schedule =\> "\* \* \* \* _"  
> }  
> }  
> filter  
> {  
> mutate  
> {  
> replace =\> ["message", "........."]  
> gsub =\> ['message','\n','']  
> **add\_field =\> { "last\_polling\_time" =\> "%{sql\_last\_value}"}**  
> remove\_field =\> [".........."]  
> }  
> if [message] =~ /^{._}$/  
> {  
> json {  
> source =\> message  
> }  
> }  
> }  
> output  
> {  
> elasticsearch {  
> ........... }  
> }

i will get

> ..........  
> ..........  
> **"last\_polling\_time": "%{sql\_last\_value}",**  
> .........  
> ..........

in the Output.

regards  
Michael

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [October 19, 2018, 8:53am UTC](https://discuss.elastic.co/t/sql-last-value-as-new-field/153143/2 "2018-10-19T08:53:54Z")

</div>

I haven't tried it, but I think you could add the placeholder to the columns of your statement like this?  
"SELECT **:sql\_last\_value** as last\_polling\_time, ...FROM ..."

(You are aware that this will contain the highest timestamp of your previous request, not the most recent one?)

---

<div class="post-metadata">

**Author:** ![mwe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mwe/32/36703_2.png) [@mwe](https://discuss.elastic.co/u/mwe)\
**Post date:** [October 19, 2018, 9:11am UTC](https://discuss.elastic.co/t/sql-last-value-as-new-field/153143/3 "2018-10-19T09:11:41Z")

</div>

Hi Jenni

thank you, great, works fine !

Yes i'm aware about it, but thx for the hint 🙂

regards  
Michael

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2018, 9:11am UTC](https://discuss.elastic.co/t/sql-last-value-as-new-field/153143/4 "2018-11-16T09:11:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.