# Using metadata for MySQL lookups

**URL:** <https://discuss.elastic.co/t/using-metadata-for-mysql-lookups/142121>\
**Category:** Logstash\
**Created:** [July 30, 2018, 8:27am UTC](https://discuss.elastic.co/t/using-metadata-for-mysql-lookups/142121 "2018-07-30T08:27:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [July 30, 2018, 8:27am UTC](https://discuss.elastic.co/t/using-metadata-for-mysql-lookups/142121/1 "2018-07-30T08:27:13Z")

</div>

Continuing the discussion from [Enriching winlogbeat data with the jdbc\_static filter](https://discuss.elastic.co/t/enriching-winlogbeat-data-with-the-jdbc-static-filter/142113):

I changed my approach and configuration from the previous thread, therefore i created a new thread because i still have the same problem.

I have the following JDBC\_STATIC lookup for syslog which works perfectly:

```
filter {
  if "syslog" in [tags] {
    jdbc_static {
      loaders => [
        {
          id => "elkDevIndexAssoc"
          query => "select * from elkDevIndexAssoc"
          local_table => "elkDevIndexAssoc"
        }
      ]
      local_db_objects => [
        {
          name => "elkDevIndexAssoc"
          index_columns => ["cenDevIP"]
          columns => [
            ["cenDevSID", "varchar(255)"],
            ["cenDevFQDN", "varchar(255)"],
            ["cenDevIP", "varchar(255)"],
            ["cenDevServiceName", "varchar(255)"]
          ]
        }
      ]
      local_lookups => [
        {
          id => "localObjects"
          query => "select * from elkDevIndexAssoc WHERE cenDevIP = :host"
          parameters => {host => "[host]"}
          target => "cendotEnhanced"
          tag_on_failure => ["sql_failure"]
        }
      ]
      # using add_field here to add & rename values to the event root
      add_field => { cendotFQDN => "%{[cendotEnhanced[0][cendevfqdn]}" }
      add_field => { cendotSID => "%{[cendotEnhanced[0][cendevsid]}" }
      add_field => { cendotServiceName => "%{[cendotEnhanced[0][cendevservicename]}" }
      remove_field => ["cendotEnhanced"]
      jdbc_user => "username"
      jdbc_password => "password"
      jdbc_driver_class => "com.mysql.jdbc.Driver"
      jdbc_driver_library => "/usr/share/java/mysql-connector-java-8.0.11.jar"
      jdbc_connection_string => "jdbc:mysql://84.19.155.71:3306/logstash?serverTimezone=Europe/Stockholm"
      #jdbc_default_timezone => "Europe/Stockholm"
      loader_schedule => "*/5 * * * *"
      add_tag => ["sql_successful"]
      tag_on_failure => ["sql_failure"]
      #tag_on_default_use => ["sql_failure"]
    }
      if ! [cendotFQDN] {
           mutate {
                  add_tag => ["sql_failure"]
           }
       }
   }
}

```

However if i use the same config with beats, i get an error complaining about the hosts field:

> [2018-07-30T10:02:02,610][WARN][logstash.filters.jdbc.lookup] Parameter field not found in event {:lookup\_id=\>"localObjects", :invalid\_parameters=\>["[host]"]}

How would i change the parameter to work with winlogbeat? I want to make a lookup on the IP where the logs originated from.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 8:27am UTC](https://discuss.elastic.co/t/using-metadata-for-mysql-lookups/142121/2 "2018-08-27T08:27:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.