[ELK] Logstash JDBC 설정

jdbc {
     jdbc_connection_string => "jdbc:postgresql://localhost:5432/test"
     jdbc_user => "test"
     jdbc_password => "test"
     jdbc_driver_class => "org.postgresql.Driver"
     jdbc_driver_library => "D:\elastic-logstash\logstash-8.10.2\lib\postgresql-42.6.0.jar"
     statement => "select * from pgdb12.ora_alarm_history where time > now() - interval '5 min'"
     jdbc_pool_timeout => 300
     schedule => "*/5 * * * *"
 }
}
filter {
    mutate {
      add_field => {"[event][dataset]"=>"db"}
      add_field => {"[data_stream][dataset]"=>"db"}
      add_field => {"[data_stream][namespace]"=>"infra"}
    }
  }
 
output{
  stdout{
    codec=>rubydebug
  }
 elasticsearch {
    hosts => ["host1:9200","host2:9200","host3:9200"]
    api_key => "--------"
    data_stream => true
    ssl => true
    manage_template => false
    cacert => "D:\elastic-logstash\logstash-8.10.2\config\http_ca.crt"
  }
}

 

 

Q. jdbc schedule을 초 단위로 할 수 없을까?

Logstash는 Quartz Scheduler를 지원하기 때문에 schedule => "* * * * * *" 6개가 가능하다