elastic / elastic/integrations

[SQL input]: Integration does not appear to function according to the selected data stream type.

Open
#16,978 1 comment 0 reactions 0 assignees View on GitHub
Integration:sql needs:triage Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

SQL Input [sql_input]

### Dataset Name

logs

### Integration Version

1.1.0

### Agent Version

9.2.3

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.3

### OS Version and Architecture

Ubuntu 25.04 X86_64

### Software/API Version

MySQL

### Error Message

_No response_

### Event Original

_No response_

### What did you do?

- I reviewed the SQL input integration and found that it gives three data stream type options: logs, metrics, and traces.
- When using the logs data stream type, the logs from MySQL are still being ingested into the Metricbeat index (metrics-sql-default).
- Furthermore, the documentation (https://www.elastic.co/docs/reference/integrations/sql) only provides details on capturing metrics from the host.

Image

### What did you see?

- SQL Input was primarily designed for getting metrics out from a DB using SQL queries. Still, the UI offers to change the **Data Stream Type**.

- We have tried to create an SQL Input integration in 9.2.3, selecting data stream type as Logs

```
- id: sql/metrics-sql-36f52cd1-e8b3-4eb3-99a9-ba68da42d281
name: sql-1
revision: 1
type: sql/metrics
use_output: default
meta:
package:
name: sql
version: 1.1.0
data_stream:
namespace: default
package_policy_id: 36f52cd1-e8b3-4eb3-99a9-ba68da42d281
streams:
- id: sql/metrics-sql.sql-36f52cd1-e8b3-4eb3-99a9-ba68da42d281
data_stream:
dataset: sql
type: metrics <--- selected Logs!
elasticsearch:
dynamic_dataset: true
dynamic_namespace: true
metricsets:
- query
hosts:
- ${SECRET_0}
driver: mysql
sql_queries:
- query: SHOW GLOBAL STATUS LIKE 'Innodb_system%'
response_format: variables
raw_data.enabled: true
period: 10s
merge_results: false
ssl: null

```

- The policy tells the input to ship to "data_stream.type": "logs", but the permissions given to the integration are

```
36f52cd1-e8b3-4eb3-99a9-ba68da42d281:
indices:
- names:
- metrics-*-*
privileges:
- auto_configure
- create_doc
```

### What did you expect to see?

- When selecting `logs` as the data stream type during the time of configuring the integration first time, it seems the expectation is that the logs be ingested to the logs data stream. Is that correct?
- Additionally, when configuring the integration and changing the data stream type, there seems to be an expectation that the customer would have the option to select the logs data stream for the logs type selected and to be ingested into it.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.