简体繁体 English

使用packetbeat捕获mysql查询响应

[英]capture mysql query response using packetbeat

原文 2018-02-25 16:53:58 7 1 elasticsearch/ packetbeat

I have used packetbeat and found it very useful. 我使用了packetbeat，发现它非常有用。

But the document does not contain the response received from the server. 但是该文档不包含从服务器收到的响应。 For eg in case of mysql, I have a field num_rows but not the actual data that is returned. 对于例如mysql，我有一个num_rows字段，但没有返回的实际数据。

https://www.elastic.co/guide/en/beats/packetbeat/current/exported-fields-mysql.html https://www.elastic.co/guide/en/beats/packetbeat/current/exported-fields-mysql.html

I checked the above page and there is no way to enable packets received from port 3306 if mysql.query can be captured, why not mysql.query_response ? 我检查了上面的页面，如果可以捕获mysql.query，则无法启用从端口3306接收的数据包，为什么不能mysql.query_response ？

Is there any other utility in beats family that can help in this? Beats家庭中是否还有其他实用程序可以帮助您呢？

1 个解决方案

As discussed in the Elastic search forums 如弹性搜索论坛中所述

https://discuss.elastic.co/t/are-the-mysql-responses-captured-by-packetbeat/47408 https://discuss.elastic.co/t/are-the-mysql-responses-captured-by-packetbeat/47408

You have to enable send_response: true in mysql protocol section to store query results. 您必须在mysql协议部分中启用send_response: true才能存储查询结果。 You can find all the parameters below 您可以在下面找到所有参数

https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-reference-yml.html https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-reference-yml.html