# Track individual sql statements executed in a DB **URL:** \ **Category:** Beats\ **Created:** [September 24, 2018, 6:29pm UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721 "2018-09-24T18:29:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![wat0075](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@wat0075](https://discuss.elastic.co/u/wat0075)\ **Post date:** [September 24, 2018, 6:29pm UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721/1 "2018-09-24T18:29:11Z")
Hello group, I am an ES newbie and one of the things I am looking at is to use ES to monitor our databases to track the sql statements that are being executed in the database over time. With this solution I would like to track sql statement string, executions, cpu, and waits (most likely other stats) per sql statement. What I would like to know is the following, 1) would the lsbeat be a good example to follow to collect info on each statement and 2) would you store a single statement per document or does it make sense to use some other index structure. I am still grasping the document structure and best practices around storing everything in one document vs splitting it out in multiple documents. Your input is appreciated. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 25, 2018, 6:51am UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721/2 "2018-09-25T06:51:34Z")
- What is the lsbeat you are referencing here? - It sounds like 1 doc per statement should be the way to go. ---
**Author:** ![wat0075](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@wat0075](https://discuss.elastic.co/u/wat0075)\ **Post date:** [September 25, 2018, 2:31pm UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721/3 "2018-09-25T14:31:48Z")
lsbeat is an example of how to build a beat. [https://www.elastic.co/guide/en/beats/devguide/current/ls-beat.html](https://www.elastic.co/guide/en/beats/devguide/current/ls-beat.html) So if I am checking for all the sql statements that have been run in the database for the last 15 seconds and keeping track of all of this for more than 5000 databases I was worried about the number of documents I would be storing. I would also need to keep a history of at least 30 days. I am sure it can be done I just want to make sure I start with a good solution before finding out I need to change it because I hit some limitation. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 26, 2018, 10:08pm UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721/4 "2018-09-26T22:08:13Z")
I just had a quick look at lsbeat and it's probably not the best example to get started as it was last updated 2 years ago and quite a few things have changed since then. Better have a look at the Beat generator here: [https://www.elastic.co/guide/en/beats/devguide/6.x/newbeat-generate.html](https://www.elastic.co/guide/en/beats/devguide/6.x/newbeat-generate.html) In think whatever way you will store it, you will have quite a lot of data assuming your databases are under load and have many queries. I would still recommend the approach one statement per document as I would assume it gives you more freedom on querying later on. As you will get a larger dataset it's important to scale your Elasticsearch cluster properly. And also: Test it first with a few servers to see if you get the expected result and performance you expect. ---
**Author:** ![wat0075](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@wat0075](https://discuss.elastic.co/u/wat0075)\ **Post date:** [September 26, 2018, 11:43pm UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721/5 "2018-09-26T23:43:01Z")
Great! Thanks for the info. ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [September 27, 2018, 12:44am UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721/6 "2018-09-27T00:44:29Z")
Just an FYI that I've created [this PR](https://github.com/elastic/beats/pull/8456) to remove the outdated section about lsbeat from the dev guide. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 22, 2018, 6:29pm UTC](https://discuss.elastic.co/t/track-individual-sql-statements-executed-in-a-db/149721/7 "2018-10-22T18:29:14Z")
This topic was automatically closed after 28 days. New replies are no longer allowed.