In this blog, I am going to explain how you can push the MySQL data into Elasticsearch using Logstash. Here I am taking the example of a BQStack website that is built using the MySQL database. So basically what I am going to do is to configure Logstash using the Logstash JDBC input plugin to connect with the MySQL database. After connecting to the MySQL database I will execute the Logstash configuration to fetch the records from the database and will push these records into the Elasticsearch index.

If you want to know the basics of Logstash then please refer to the "Introduction to Logstash" blog where I have explained the basics of Logstash.

Once we push the data from the MySQL database into Elasticsearch, we can create the dashboards in Kibana as per our requirement. I am using the Ubuntu OS for this configuration demonstration. Now let us start the process using which we can push MySQL data into Elasticsearch. For that, we first need to create the Logstash configuration file inside /etc/logstash/conf.d/ directory. So let us create a file as blog.conf and write the following code:

# file: blog.conf
input {
    jdbc {
        jdbc_driver_library => "/usr/share/logstash/mysql-connector-java-5.1.23-bin.jar"
        jdbc_driver_class => "com.mysql.jdbc.Driver"
        # mysql jdbc connection string to our database, mydb
         jdbc_connection_string => "jdbc:mysql://url-of-db:3306/db_name?zeroDateTimeBehavior=convertToNull"
        # The user we wish to execute our statement as
        jdbc_user => "username"
        jdbc_password => "password"
        schedule => "* * * * *"
        # our query to fetch blog details
        statement => "SELECT blg.*, concat(au.first_name, ' ',au.last_name) as name,au.email as email, cc.category_name, cc.category_image  FROM `blog_blogs` as blg left join auth_user as au on au.id = blg.author_id left join category_category as cc on cc.id = blg.category_id where blg.id > :sql_last_value order by blg.create_date"
        use_column_value => true
        tracking_column => id
        tracking_column_type => "numeric"
    }
}
output {
   elasticsearch {
        hosts => "http://127.0.0.1:9200"
        index => "bqstack"
        document_type => "blogs"
        }
}

In the above Logstash configuration file, we have input and output section, under the input section, we are connecting to MySQL database for fetching the data and under the output section, we are sending that data to Elasticsearch cluster.  Under the input section, we are using the JDBC plugin where the first is jdbc_driver_library which tells the JDBC driver library path. JDBC input plugin does not contain the JDBC driver so we need to download it and then provide the path under the jdbc_driver_library parameter. Next is jdbc_driver_class where we need to provide the driver class, then we need to provide the JDBC connection string. For connection string, it has a fixed syntax where we have to provide the DB type, URL of the database, the port of database, database name, and then we need to set username and password parameters of the database.

Once these database connection related parameters are set we can set the scheduler by setting the schedule parameter after that we have to write the actual query which we are going to execute on the MySQL database after a successful connection. There is a specific syntax using which we can set the schedule frequency. The syntax for the JDBC input plugin is quite similar to the cron job. For example:

"* * * * * " => runs every second
"30 2 * * *" => runs as 2:30AM
"10 22 * * *" => runs at 10:10PM

The statement parameter is there to write the query, in the above query I have compared the blog id with sql_last_value which is dynamic and refers to the id column of the table. After each query execution, the value of sql_last_value is updated and set in a file. Next time the query is executed this value is picked from the file. We are providing the data type of the tracking column along with the tracking column name, an id is a numeric value so I have given it as a numeric type for tracking_column_type parameter.

After doing all those configuration changes we need to execute Logstash configuration using the following command on Ubuntu:

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/blog.conf --path.data=/tmp/bq

This is a one time command and after running it, the scheduler will start working as per our scheduler entry, the query will be executed every second. We can do the cron entry to auto start the Logstash configuration execution once the system restarts. We need to run the following command for opening the crontab in Linux:

crontab -e

The above command opens the crontab file where we can write the following entry to ensure that after machine restart Logstash configuration is executed and the JDBC input plugin scheduler starts executing the queries to fetch the data from the database.

@reboot /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/blog.conf --path.data=/tmp/bq

The above crontab entry starts with @reboot which works after each machine restart after that we have given the expression to execute the Logstash configuration.

In this way, we can configure Logstash using the JDBC input plugin to read the RDBMS data and put it into Elasticsearch. Once data is there in Elasticsearch we can create the visualizations and dashboards using Kibana.

Other Blogs on Elastic Stack:

Configure Logstash to push MongoDB data into Elasticsearch
Load CSV Data into Elasticsearch
Introduction to Elasticsearch
Elasticsearch Installation and Configuration on Ubuntu 14.04
Log analysis with Elastic stack 
Elasticsearch Rest API
Basics of Data Search in Elasticsearch
Elasticsearch Rest API
Wildcard and Boolean Search in Elasticsearch
Metrics Aggregation in Elasticsearch
Bucket Aggregation in Elasticsearch
How to create Elasticsearch Cluster