Skip to content

Metricbeat sql module: error mapping the query property #15736

@narph

Description

@narph

Initial ticket #13257

An example of event to be sent to es or other output looks like:

{ 
   "index":{ 
      "_index":"metricbeat-7.6.0"
   }
}{ 
   "@timestamp":"2020-01-22T10:20:53.035Z",
   "ecs":{ 
      "version":"1.4.0"
   },
   "host":{ 
      "name":"DESKTOP-RFOOE09",
      "hostname":"DESKTOP-RFOOE09",
      "architecture":"x86_64",
      "os":{ 
         "build":"18362.535",
         "platform":"windows",
         "version":"10.0",
         "family":"windows",
         "name":"Windows 10 Pro",
         "kernel":"10.0.18362.535 (WinBuild.160101.0800)"
      },
      "id":"1e50b6e1-9710-4164-a8f0-032b3c721dc3"
   },
   "agent":{ 
      "type":"metricbeat",
      "ephemeral_id":"b953f038-ca66-4fdc-99a8-44768ca8d753",
      "hostname":"DESKTOP-RFOOE09",
      "id":"4a1576f3-cd1f-4b8b-90d6-5918f5cb5d71",
      "version":"7.6.0"
   },
   "event":{ 
      "dataset":"sql.query",
      "module":"sql",
      "duration":76667500
   },
   "metricset":{ 
      "period":10000,
      "name":"query"
   },
   "service":{ 
      "address":"localhost:5433",
      "type":"sql"
   },
   "sql":{ 
      "driver":"postgres",
      "query":"select now()",
      "metrics":{ 
         "string":{ 
            "now":"2020-01-22 11:20:53.112"
         }
      }
   }
}

but in the fields.yml definition query is not a string property:

release: beta
  description: >
    query
  fields:
    - name: driver
      type: keyword
      description: >
        Driver used to execute the query.

ES is returning the errors:

","status":400,"error":{"type":"mapper_parsing_exception","reason":"object mapping for [sql.query] tried to parse field [query] as object, but found a concrete value"}}

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions