Timestamp at Input section

Elastic Stack Logstash
#1

Hello Guys,

I am utilizing the @timestamp field in a DB2 Query. I am using the JDBC plugin, where in I am relying on the @timestamp field for my date parameters.

Now, thing is I cannot use the @timestamp because it has the T, Z and : in it's value(2016-09-01T19:21:08.702Z). Is there a way to parse it at the input section so I can omit the T, Z and colons?

#2

Can you share your config? You can generally format dates using sprintf format like %{yyyy-mm-dd}

1 Like
#3

Hi Andrew,

I cant share my config File.
I tried to google that sprintf you indicated. As I saw in the documentation, this cannot be done in the Input section.

Field references, sprintf format and conditionals, described below,
will not work in an input block.

Also, as I see in the examples it is only used in the outputs. Is there no other way? :smiley:

#4

How are you pulling the timestamp from @timestamp in an input? There's no event to pull it from.

This is far too confusing to understand without a config file. Can you just share your JDBC input config?

1 Like
#5

Hello!

Yep, that I can share.

input {

if [@timestamp] < "01:00:00.000Z" and [@timestamp] > "02:00:00.000Z" {
    stdin {
        add_field => { "dummy" => "'2016-09-01-00.00.00' AND '2016-09-01-02.59.00'"}
    }
}

jdbc {
    jdbc_driver_library => "jarFiles/db2jcc-10.1.0.jar"
    jdbc_driver_class => "com.ibm.db2.jcc.DB2Driver"
    jdbc_connection_string => "jdbc:db2://localhost:9200/dummyDB"
    schedule => "59 * * * *"
    statement => "select content from rawbcmsg where LASTUPDATE BETWEEN %{dummy}"
    type => "CDT1"
}

}

Thanks,

#6

I think the confusion here is that the stdin input does not at all have any way to conect to the jdbc input. You would need a JDBC filter which we do not unfortunately have. It'd be awesome if someone made one however!

#7

To expand on that, inputs can only generate events, they cannot react to other inputs.

1 Like
#8

I guess that answers my question Andrew,Thanks.

#9