Sql query returns nothing , but output file udpated

Elastic Stack Logstash
1

Hi,
I'm using jdbc input streaming filter to get the data from query. but in some cases query returns empty or null value.
<
last_run_metadata_path => <filepath/sql_last_value.yml
statement_filepath => <filepath/query.sql>
target => "test"
/>
below is the query result if data not empty
<
{"created"=>"2023-12-19"}
/>
and in output plugin writing this date in file
<
file {
path => <filepath/sql_last_value.yml>
codec => line { format => "datetime '%{created}'"}
write_behavior => "overwrite"
}
/>
I dont want to set/update file if sql query not returning anything. I have tried below code but it is not working. still its updating file with datetime at what pipeline executing.
<
if [test] {
file {
path => <filepath/sql_last_value.yml>
codec => line { format => "datetime '%{created}'"}
write_behavior => "overwrite"
}
}
/>
can anybody tell me how to handle this?

2

I'm going to assume that you are using a jdbc_streaming filter rather than a jdbc input.

When there is no match in the jdbc_streaming filter then the target is set to a default_hash. Thus [test] will always exist, although if there is no match it will just be an empty hash.

Try if [test][created].

3

Thanks. But if i use jdbc_input instead of jdbc_streaming then how to achieve this ? after execution of every pipeline schedule the output file is updating even though result is empty. Why it is updating?

4

A quick Googling suggests that the same answer applies to the jdbc input. Creating a new event probably results in an empty hash as the target.

Try it, let us know.