Search code examples
elasticsearchpacketbeat

capture mysql query response using packetbeat

I have used packetbeat and found it very useful.

But the document does not contain the response received from the server. For e.g. in case of mysql, I have a field num_rows but not the actual data that is returned.

https://www.elastic.co/guide/en/beats/packetbeat/current/exported-fields-mysql.html

I checked the above page and there is no way to enable packets received from port 3306 if mysql.query can be captured, why not mysql.query_response?

Is there any other utility in beats family that can help in this?

Solution

  • As discussed in the Elastic search forums

    https://discuss.elastic.co/t/are-the-mysql-responses-captured-by-packetbeat/47408

    You have to enable send_response: true in mysql protocol section to store query results. You can find all the parameters below

    https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-reference-yml.html