Database Batch Destination

Definition

Protocol

Action

Description

Insert events into SQL Database in batches. Map event fields to database fields using EventFieldsToDbFields. Write to database every Number (default 1000) events or every TimeInterval (default 5 seconds), whichever is sooner.
At system initialization SQL Command will be executed.
Log into DatabaseLogin.
Create a new event from the results of the SQL command execution, setting FieldName to its error output, sending the new event to DestinationName.

Comments

Event Field	Contents
ev:host	hostname
ev:app	SQL Database
ev:log	<Database URI>

The SQL command is triggered by the arrival of an event so that it can write events into a database table depending on the specified SQL expression.

If EventFieldsToDbFields or DatabaseLogin is missing, blank or invalid the writer will be disabled.

If DestinationName is missing, blank or invalid a new event will not be sent.

Special XML characters are translated according to the XML Character Translation Table.

Example

<destination objectId="DbBatchDest" type=" DbBatchDestination" stdout="FS.DemoAlive">
	<parameter type="Command">select * from Events where Events.host = ‘SafeHost'</parameter>
	<parameter type="FieldName">ev:dbErrs</parameter>
	<parameter type="DestinationName">Dest.tcpOut</parameter>
	<parameter type=”DatabaseLogin”>
		<url>jdbc:mysql://localhost/events</url>
		<driver>org.gjt.mm.mysql.Driver</driver>
		<user>username</user>
		<password>pass</password>
	</parameter>
	<parameter type="EventFieldToDbField">
		<MapEventFieldToDBField>
			<EventField>ev:host</EventField>
			<DBFieldName>HOST</DbFieldName>
			<DbFieldType>VARCHAR</DbFieldType>
		</MapEventFieldToDbField>
		<MapEventFieldToDbField>
			<EventField>ev:app</EventField>
			<DbFieldName>APP</DbFieldName>
			<DbFieldType>VARCHAR</DbFieldType>
		</MapEventFieldToDbField>
		<MapEventFieldToDbField>
			<EventField>ev:log</EventField>
			<DbFieldName>LOG</DbFieldName>
			<DbFieldType>VARCHAR</DbFieldType>
		</MapEventFieldToDbField>
		<MapEventFieldToDbField>
			<EventField>ev:msg</EventField>
			<DbFieldName>MESSAGE</DbFieldName>
			<DbFieldType>TEXT</DbFieldType>
		</MapEventFieldToDbField>
		<MapEventFieldToDbField>
			<EventField>ev:srctime</EventField>
			<DbFieldName>SRC_TIME</DbFieldName>
			<DbFieldType>TIMESTAMP</DbFieldType>
		</MapEventFieldToDbField>
	</parameter>
</destination>

Event Mapping

Resulting XML:

<event xmlns:ev="http://www.eventgnosis.com/">
	<ev:host>filipov</ev:host>
	<ev:app>SQL Command</ev:app>
	<ev:log>jdbc:mysql://localhost/events</ev:log>
	<ev:msg>Here is a message from the database</ev:log>
	<ev:srctime> Feb 25 2003 12:34:56 </ev:log>
	<ev:dbErrs></ev:dbErrs>
	<ev:SQLCommand.StartTime> Feb 25 2003 12:34:56 </ev:SQLCommand.StartTime>
	<ev: SQLCommand.EndTime> Feb 20, 2003 13:45:53 </ev:SQLCommand.EndTime>
	<ev: SQLCommand.ExecutionSecs>13</ev:SQLCommand.ExecutionSecs>
	<ev:SQLCommand.CommandString>select * from hostJZ where event.host = ‘JP'</ev:SQLCommand.CommandString>
	<ev:SQLCommand.ErrorStatus>-32</ev:SQLCommand.ErrorStatus>
</event>