Configuring ODBC Enrichment Source consists of two steps:
Go to Settings >> Configuration >> Enrichment Sources.
Click Add.
Adding an Enrichment Source¶
Select ODBC.
Adding ODBC as an Enrichment Source¶
In CONNECTION PARAMETERS:
Enter a Name.
Select the Charset.
Select the ODBC Driver.
Enter the Server IP and the Port number of the ODBC server.
Enter the Database name.
Enter the Username and Password to access the ODBC server.
Enter a SQL Query to fetch the data.
Use ENRICHMENT OPTIONS to add or configure parameters that control enrichment frequency. You also need to decide that when new enrichment data is fetched, whether it is added to existing Logpoint based data or replaces existing data.
Select an Age Limit, the retention period for data. For example, if you set it as 5 Hour, the fetched data is deleted after 5 hours.
Select an Update Interval, the period of time at which data is updated. For example, if you set it as 1 Hour, data from the odbc server is fetched every 1 hour.
In Type, select
Update to add the new data with the existing.
Enter Increment Key, the primary key to access new records from the ODBC database.
Enter Increment Key Table, the value of the previously entered Incremental Key.
Enter a New Line Separator.
Replace to replace existing data with the new.
If the connection to the server is successful, Logpoint fetches data from the ODBC server in a table format, and SOURCE FIELDS displays all the columns of the fetched table along with the sample data.
Table columns along with sample data¶
If the entered credentials are incorrect, you get an error message.
Error message if credentials are incorrect¶
Select the Type of sample data from the drop-down.
Click Save.
After adding ODBC enrichment source, Logpoint creates a table with the name you assigned. To view the table:
Go to Settings >> Configuration >> Enrichment Sources.
Click Search (
) icon from Actions. It will take you to the Logpoint Search. You can also view the table directly from Search using the Table query.
Searching the ODBC Enrichment Source Table with Enrichment Data¶
Verifying the presence of enrichment table in Logpoint Search means you can now add new enrichment policy that uses the data based in the table to enrich your logs. To do so, go to Adding Enrichment Policy.
In the example below, you can see odbctable used as an Enrichment Source. If the value of col_type from the log matches the value of col_type1 from the enrichment table, Logpoint enriches the log using the data from the table.
Adding Enrichment Policy using ODBC Source¶