Jdbc input plugin

Some databases - such as Sybase or SQL Anywhere - may have issues with stale connections, timing out between scheduled runs and never reconnecting.

To ensure connections are valid before queries are executed, enable jdbc_validate_connection and set jdbc_validation_timeout to a shorter interval than the schedule.

input {
  jdbc {
    schedule => "* * * * *"       # run every minute
    jdbc_validate_connection => true
    jdbc_validation_timeout => 50 # 50 seconds
  }
}

Whether the previous run state should be preserved

The character encoding for specific columns. This option will override the :charset option for the specified columns.

Example:

input {
  jdbc {
    ...
    columns_charset => { "column0" => "ISO-8859-1" }
    ...
  }
}

this will only convert column0 that has ISO-8859-1 as an original encoding.

Maximum number of times to try connecting to database

Number of seconds to sleep between connection attempts

JDBC connection string

While it is common to store local times in SQL’s timestamp column type, many timezones change their offset during the course of a calendar year and therefore cannot be used with SQL’s timestamp type to represent an ordered, continuous timeline. For example in the America/Chicago zone when daylight saving time (DST) ends in the autumn, the clock rolls from 01:59:59 back to 01:00:00, making any timestamp in the 2-hour period between 01:00:00CDT and 02:00:00CST on that day ambiguous.

When encountering an ambiguous timestamp caused by a DST transition, the query will fail unless the timezone specified here includes a square-bracketed instruction for how to handle overlapping periods (such as: America/Chicago[dst_enabled_on_overlap:true] or Australia/Melbourne[dst_enabled_on_overlap:false]).

If you want this plugin to offset timestamps to a timezone other than UTC, you can set this setting to local and the plugin will use the OS timezone for offset adjustments.

Note: when specifying plugin_timezone and/or jdbc_default_timezone, offset adjustments are made in two places, if sql_last_value is a timestamp and it is used as a parameter in the statement then offset adjustment is done from the plugin timezone into the data timezone and while records are processed, timestamps are offset adjusted from the database timezone to the plugin timezone. If your database timezone is UTC then you do not need to set either of these settings.

JDBC driver class to load, for example, "org.apache.derby.jdbc.ClientDriver"

JDBC driver library path to third party driver library. In case of multiple libraries being required you can pass them separated by a comma.

JDBC fetch size. if not provided, respective driver’s default will be used

JDBC page size

JDBC enable paging

This will cause a sql statement to be broken up into multiple queries. Each query will use limits and offsets to collectively retrieve the full result-set. The limit size is set with jdbc_page_size.

Be aware that ordering is not guaranteed between queries.

Whether to use explicit or auto mode during the JDBC paging

If auto, your statement will be automatically surrounded by a count query and subsequent multiple paged queries (with LIMIT statement, etc.).

If explicit, multiple queries (without a count query ahead) will be performed with your statement, until no more rows are retrieved. You have to write your own paging conditions in your statement configuration. The offset and size parameters can be used in your statement (size equal to jdbc_page_size, and offset incremented by size for each query). When the number of rows returned by the query is not equal to size, SQL paging will be ended. Example:

input {
  jdbc {
    statement => "SELECT id, mycolumn1, mycolumn2 FROM my_table WHERE id > :sql_last_value LIMIT :size OFFSET :offset",
    jdbc_paging_enabled => true,
    jdbc_paging_mode => "explicit",
    jdbc_page_size => 100000
  }
}

input {
  jdbc {
    statement => "CALL fetch_my_data(:sql_last_value, :offset, :size)",
    jdbc_paging_enabled => true,
    jdbc_paging_mode => "explicit",
    jdbc_page_size => 100000
  }
}

This mode can be considered in the following situations:

JDBC password

JDBC password filename

Connection pool configuration. The amount of seconds to wait to acquire a connection before raising a PoolTimeoutError (default 5)

JDBC user

Connection pool configuration. Validate connection before use.

Connection pool configuration. How often to validate a connection (in seconds)

Path to file with last run time

In versions prior to 5.2.6 the metadata file was written to $HOME/.logstash_jdbc_last_run. If during a Logstash upgrade the file is found in "$HOME" it will be moved to the default location under "path.data". If the path is defined by the user then no automatic move is performed.

Whether to force the lowercasing of identifier fields

Hash of query parameter, for example { "target_id" => "321" }

Array of bind values for the prepared statement. :sql_last_value is a reserved predefined string

Name given to the prepared statement. It must be unique in your config and in the database

Whether to save state or not in last_run_metadata_path

Schedule of when to periodically run statement, in Cron format for example: "* * * * *" (execute query every minute, on the minute)

There is no schedule by default. If no schedule is given, then the statement is run exactly once.

General/Vendor-specific Sequel configuration options.

An example of an optional connection pool configuration max_connections - The maximum number of connections the connection pool

examples of vendor-specific options can be found in this documentation page: https://github.com/jeremyevans/sequel/blob/master/doc/opening_databases.rdoc

Log level at which to log SQL queries, the accepted values are the common ones fatal, error, warn, info and debug. The default value is info.

If undefined, Logstash will complain, even if codec is unused. Statement to execute

To use parameters, use named parameter syntax. For example:

"SELECT * FROM MYTABLE WHERE id = :target_id"

here, ":target_id" is a named parameter. You can configure named parameters with the parameters setting.

Path of file containing statement to execute

Without a target, events are created from each row column at the root level. When the target is set to a field reference, the column of each row is placed in the target field instead.

This option can be useful to avoid populating unknown fields when a downstream schema such as ECS is enforced.

The column whose value is to be tracked if use_column_value is set to true

Type of tracking column. Currently only "numeric" and "timestamp"

When set to true, uses the defined tracking_column value as the :sql_last_value. When set to false, :sql_last_value reflects the last time the query was executed.

When set to true, enables prepare statement usage

Add a field to an event

The codec used for input data. Input codecs are a convenient method for decoding your data before it enters the input, without needing a separate filter in your Logstash pipeline.

Disable or enable metric logging for this specific plugin instance by default we record all the metrics we can, but you can disable metrics collection for a specific plugin.

Add a unique ID to the plugin configuration. If no ID is specified, Logstash will generate one. It is strongly recommended to set this ID in your configuration. This is particularly useful when you have two or more plugins of the same type, for example, if you have 2 jdbc inputs. Adding a named ID in this case will help in monitoring Logstash when using the monitoring APIs.

input {
  jdbc {
    id => "my_plugin_id"
  }
}

Add any number of arbitrary tags to your event.

This can help with processing later.

Add a type field to all events handled by this input.

Types are used mainly for filter activation.

The type is stored as part of the event itself, so you can also use the type to search for it in Kibana.

If you try to set a type on an event that already has one (for example when you send an event from a shipper to an indexer) then a new input will not override the existing type. A type set at the shipper stays with that event for its life even when sent to another Logstash server.