Config File (if you have sensitive info, please remove it):
filter {
jdbc_static {
loaders => [
{
id => "remote-servers"
query => "select ip, descr from ref.local_ips order by ip"
table => "servers"
}
]
local_db_objects => [
{
name => "servers"
index_columns => ["ip"]
columns => [
["ip", "varchar(15)"],
["descr", "varchar(255)"]
]
}
]
local_lookups => [
{
id => "local-servers"
query => "select descr as description from servers WHERE ip = :ip"
parameters => {ip => "[from_ip]"}
target => "server"
}
]
loader_schedule => "* */2 * * *" # run loaders every 2 hours
jdbc_user => "logstash"
jdbc_password => "example"
jdbc_driver_class => "org.postgresql.Driver"
jdbc_driver_library => "/tmp/logstash/vendor/postgresql-42.1.4.jar"
jdbc_connection_string => "jdbc:postgresql://remotedb:5432/ls_test_2"
}
}
Sample Data: N/A
Steps to Reproduce:
sudo /usr/share/logstash/bin/logstash -f config.conf --config.test_and_exit --debug
Relevant error messages
[ERROR] 2020-11-30 16:22:25.749 [LogStash::Runner] jdbcstatic - Invalid setting for jdbc_static filter plugin:
filter {
jdbc_static {
# This setting must be a [LogStash::Filters::Jdbc::Loader]
# The options must include a 'local_table' string
loaders => [{"id"=>"remote-servers", "query"=>"select ip, descr from ref.local_ips order by ip", "table"=>"servers"}]
...
}
}
Brief:
The docs on elastic.co are incorrect. while the examples contains the correct information, the plugin detail does not.
Specifically under loaders, table should be updated to local_table https://www.elastic.co/guide/en/logstash/6.7/plugins-filters-jdbc_static.html#plugins-filters-jdbc_static-loaders
Config File (if you have sensitive info, please remove it):
sudo /usr/share/logstash/bin/logstash -f config.conf --config.test_and_exit --debug
Relevant error messages