You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit elastic.co/guide.

MySQL

Collect logs and metrics from MySQL servers with Elastic Agent.

What is an Elastic integration?
Version
1.19.0 (View all)
Compatible Kibana version(s)
8.12.0 or higher
Supported Serverless project types

What's this?
Security
Observability
Subscription level
What's this?
Basic
Level of support
What's this?
Elastic

This integration periodically fetches logs and metrics from MySQL servers.

Compatibility

The error and slowlog datasets were tested with logs from MySQL 5.5, 5.7 and 8.0, MariaDB 10.1, 10.2 and 10.3, and Percona 5.7 and 8.0.

The galera_status and status datasets were tested with MySQL and Percona 5.7 and 8.0 and are expected to work with all versions >= 5.7.0. It is also tested with MariaDB 10.2, 10.3 and 10.4.

Logs

error

The error dataset collects the MySQL error logs.

Exported fields

FieldDescriptionType
@timestamp
Event timestamp.
date
cloud.account.id
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
keyword
cloud.availability_zone
Availability zone in which this host is running.
keyword
cloud.image.id
Image ID for the cloud instance.
keyword
cloud.instance.id
Instance ID of the host machine.
keyword
cloud.instance.name
Instance name of the host machine.
keyword
cloud.machine.type
Machine type of the host machine.
keyword
cloud.project.id
Name of the project in Google Cloud.
keyword
cloud.provider
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
keyword
cloud.region
Region in which this host is running.
keyword
container.id
Unique container id.
keyword
container.image.name
Name of the image the container was built on.
keyword
container.labels
Image labels.
object
container.name
Container name.
keyword
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
ecs.version
ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
keyword
error.message
Error message.
match_only_text
event.category
Event category (e.g. database)
keyword
event.code
Identification code for this event
keyword
event.created
Date/time when the event was first read by an agent, or by your pipeline.
date
event.dataset
Event dataset
constant_keyword
event.kind
Event kind (e.g. event)
keyword
event.module
Event module
constant_keyword
event.original
Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from _source. If users wish to override this and index this field, please see Field data types in the Elasticsearch Reference.
keyword
event.provider
Source of the event (e.g. Server)
keyword
event.timezone
Time zone information
keyword
event.type
Event severity (e.g. info, error)
keyword
host.architecture
Operating system architecture.
keyword
host.containerized
If the host is a container.
boolean
host.domain
Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
keyword
host.hostname
Hostname of the host. It normally contains what the hostname command returns on the host machine.
keyword
host.id
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.
keyword
host.ip
Host ip addresses.
ip
host.mac
Host mac addresses.
keyword
host.name
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
keyword
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
host.os.family
OS family (such as redhat, debian, freebsd, windows).
keyword
host.os.kernel
Operating system kernel version as a raw string.
keyword
host.os.name
Operating system name, without the version.
keyword
host.os.name.text
Multi-field of host.os.name.
text
host.os.platform
Operating system platform (such centos, ubuntu, windows).
keyword
host.os.version
Operating system version as a raw string.
keyword
host.type
Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.
keyword
input.type
Type of Filebeat input.
keyword
log.file.path
Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field.
keyword
log.flags
Log flags.
keyword
log.level
Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are warn, err, i, informational.
keyword
log.offset
Offset of the entry in the log file.
long
message
For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.
match_only_text
mysql.thread_id
The connection or thread ID for the query.
long
tags
List of keywords used to tag each event.
keyword

slowlog

The slowlog dataset collects the MySQL slow logs.

Exported fields

FieldDescriptionType
@timestamp
Event timestamp.
date
cloud.account.id
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
keyword
cloud.availability_zone
Availability zone in which this host is running.
keyword
cloud.image.id
Image ID for the cloud instance.
keyword
cloud.instance.id
Instance ID of the host machine.
keyword
cloud.instance.name
Instance name of the host machine.
keyword
cloud.machine.type
Machine type of the host machine.
keyword
cloud.project.id
Name of the project in Google Cloud.
keyword
cloud.provider
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
keyword
cloud.region
Region in which this host is running.
keyword
container.id
Unique container id.
keyword
container.image.name
Name of the image the container was built on.
keyword
container.labels
Image labels.
object
container.name
Container name.
keyword
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
ecs.version
ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
keyword
error.message
Error message.
match_only_text
event.dataset
Event dataset
constant_keyword
event.duration
Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time.
long
event.module
Event module
constant_keyword
host.architecture
Operating system architecture.
keyword
host.containerized
If the host is a container.
boolean
host.domain
Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
keyword
host.hostname
Hostname of the host. It normally contains what the hostname command returns on the host machine.
keyword
host.id
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.
keyword
host.ip
Host ip addresses.
ip
host.mac
Host mac addresses.
keyword
host.name
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
keyword
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
host.os.family
OS family (such as redhat, debian, freebsd, windows).
keyword
host.os.kernel
Operating system kernel version as a raw string.
keyword
host.os.name
Operating system name, without the version.
keyword
host.os.name.text
Multi-field of host.os.name.
text
host.os.platform
Operating system platform (such centos, ubuntu, windows).
keyword
host.os.version
Operating system version as a raw string.
keyword
host.type
Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.
keyword
input.type
Type of Filebeat input.
keyword
log.file.path
Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field.
keyword
log.flags
Log flags.
keyword
log.offset
Offset of the entry in the log file.
long
message
For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.
match_only_text
mysql.slowlog.bytes_received
The number of bytes received from client.
long
mysql.slowlog.bytes_sent
The number of bytes sent to client.
long
mysql.slowlog.current_user
Current authenticated user, used to determine access privileges. Can differ from the value for user.
keyword
mysql.slowlog.filesort
Whether filesort optimization was used.
boolean
mysql.slowlog.filesort_on_disk
Whether filesort optimization was used and it needed temporary tables on disk.
boolean
mysql.slowlog.full_join
Whether a full join was needed for the slow query (no indexes were used for joins).
boolean
mysql.slowlog.full_scan
Whether a full table scan was needed for the slow query.
boolean
mysql.slowlog.innodb.io_r_bytes
Bytes read during page read operations.
long
mysql.slowlog.innodb.io_r_ops
Number of page read operations.
long
mysql.slowlog.innodb.io_r_wait.sec
How long it took to read all needed data from storage.
long
mysql.slowlog.innodb.pages_distinct
Approximated count of pages accessed to execute the query.
long
mysql.slowlog.innodb.queue_wait.sec
How long the query waited to enter the InnoDB queue and to be executed once in the queue.
long
mysql.slowlog.innodb.rec_lock_wait.sec
How long the query waited for locks.
long
mysql.slowlog.innodb.trx_id
Transaction ID
keyword
mysql.slowlog.killed
Code of the reason if the query was killed.
keyword
mysql.slowlog.last_errno
Last SQL error seen.
keyword
mysql.slowlog.lock_time.sec
The amount of time the query waited for the lock to be available. The value is in seconds, as a floating point number.
float
mysql.slowlog.log_slow_rate_limit
Slow log rate limit, a value of 100 means that one in a hundred queries or sessions are being logged.
long
mysql.slowlog.log_slow_rate_type
Type of slow log rate limit, it can be session if the rate limit is applied per session, or query if it applies per query.
keyword
mysql.slowlog.merge_passes
Number of merge passes executed for the query.
long
mysql.slowlog.priority_queue
Whether a priority queue was used for filesort.
boolean
mysql.slowlog.query
The slow query.
keyword
mysql.slowlog.query_cache_hit
Whether the query cache was hit.
boolean
mysql.slowlog.read_first
The number of times the first entry in an index was read.
long
mysql.slowlog.read_key
The number of requests to read a row based on a key.
long
mysql.slowlog.read_last
The number of times the last key in an index was read.
long
mysql.slowlog.read_next
The number of requests to read the next row in key order.
long
mysql.slowlog.read_prev
The number of requests to read the previous row in key order.
long
mysql.slowlog.read_rnd
The number of requests to read a row based on a fixed position.
long
mysql.slowlog.read_rnd_next
The number of requests to read the next row in the data file.
long
mysql.slowlog.rows_affected
The number of rows modified by the query.
long
mysql.slowlog.rows_examined
The number of rows scanned by the query.
long
mysql.slowlog.rows_sent
The number of rows returned by the query.
long
mysql.slowlog.schema
The schema where the slow query was executed.
keyword
mysql.slowlog.sort_merge_passes
Number of merge passes that the sort algorithm has had to do.
long
mysql.slowlog.sort_range_count
Number of sorts that were done using ranges.
long
mysql.slowlog.sort_rows
Number of sorted rows.
long
mysql.slowlog.sort_scan_count
Number of sorts that were done by scanning the table.
long
mysql.slowlog.tmp_disk_tables
Number of temporary tables created on disk for this query.
long
mysql.slowlog.tmp_table
Whether a temporary table was used to resolve the query.
boolean
mysql.slowlog.tmp_table_on_disk
Whether the query needed temporary tables on disk.
boolean
mysql.slowlog.tmp_table_sizes
Size of temporary tables created for this query.
long
mysql.slowlog.tmp_tables
Number of temporary tables created for this query
long
mysql.thread_id
The connection or thread ID for the query.
long
source.domain
The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.
keyword
source.ip
IP address of the source (IPv4 or IPv6).
ip
tags
List of keywords used to tag each event.
keyword
user.name
Short name or login of the user.
keyword
user.name.text
Multi-field of user.name.
match_only_text

Metrics

galera_status

The galera_status dataset periodically fetches metrics from Galera-MySQL cluster servers.

An example event for galera_status looks as following:

{
    "@timestamp": "2023-03-20T11:04:23.272Z",
    "agent": {
        "ephemeral_id": "c1cb5a26-c138-4c91-b980-e920faa46892",
        "id": "a6bbda96-646d-4211-bac8-b40bdd093a0c",
        "name": "docker-fleet-agent",
        "type": "metricbeat",
        "version": "8.6.0"
    },
    "data_stream": {
        "dataset": "mysql.galera_status",
        "namespace": "default",
        "type": "metrics"
    },
    "ecs": {
        "version": "8.0.0"
    },
    "elastic_agent": {
        "id": "a6bbda96-646d-4211-bac8-b40bdd093a0c",
        "snapshot": false,
        "version": "8.6.0"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "mysql.galera_status",
        "duration": 17113542,
        "ingested": "2023-02-06T15:07:41Z",
        "module": "mysql"
    },
    "host": {
        "architecture": "x86_64",
        "containerized": false,
        "hostname": "docker-fleet-agent",
        "id": "589e678e8f3f457d81e3a530d3ae6011",
        "ip": [
            "172.28.0.7"
        ],
        "mac": [
            "02-42-AC-1C-00-07"
        ],
        "name": "docker-fleet-agent",
        "os": {
            "codename": "focal",
            "family": "debian",
            "kernel": "5.10.104-linuxkit",
            "name": "Ubuntu",
            "platform": "ubuntu",
            "type": "linux",
            "version": "20.04.5 LTS (Focal Fossa)"
        }
    },
    "metricset": {
        "name": "galera_status",
        "period": 10000
    },
    "mysql": {
        "galera_status": {
            "connected": "ON",
            "cluster": {
                "size": 1,
                "conf_id": 1,
                "status": "Primary"
            },
            "evs": {
                "state": "OPERATIONAL",
                "evict": ""
            },
            "apply": {
                "oooe": 0,
                "oool": 0,
                "window": 0
            },
            "ready": "ON",
            "flow_ctl": {
                "paused_ns": 0,
                "paused": 0,
                "recv": 0,
                "sent": 0
            },
            "last_committed": 0,
            "commit": {
                "oooe": 0,
                "window": 0
            },
            "cert": {
                "index_size": 0,
                "deps_distance": 0,
                "interval": 0
            },
            "received": {
                "bytes": 147,
                "count": 2
            },
            "repl": {
                "bytes": 0,
                "keys": 0,
                "keys_bytes": 0,
                "count": 0,
                "other_bytes": 0,
                "data_bytes": 0
            },
            "local": {
                "replays": 0,
                "recv": {
                    "queue_max": 1,
                    "queue_min": 0,
                    "queue_avg": 0,
                    "queue": 0
                },
                "bf_aborts": 0,
                "commits": 0,
                "state": "Synced",
                "cert_failures": 0,
                "send": {
                    "queue_max": 2,
                    "queue_min": 0,
                    "queue_avg": 0.5,
                    "queue": 0
                }
            }
        }
    },
    "service": {
        "address": "tcp(host.docker.internal:3306)/?readTimeout=10s\u0026timeout=10s\u0026writeTimeout=10s",
        "type": "mysql"
    }
}

Exported fields

FieldDescriptionTypeMetric Type
@timestamp
Event timestamp.
date
agent.id
keyword
cloud.account.id
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
keyword
cloud.availability_zone
Availability zone in which this host is running.
keyword
cloud.image.id
Image ID for the cloud instance.
keyword
cloud.instance.id
Instance ID of the host machine.
keyword
cloud.instance.name
Instance name of the host machine.
keyword
cloud.machine.type
Machine type of the host machine.
keyword
cloud.project.id
Name of the project in Google Cloud.
keyword
cloud.provider
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
keyword
cloud.region
Region in which this host is running.
keyword
container.id
Unique container id.
keyword
container.image.name
Name of the image the container was built on.
keyword
container.labels
Image labels.
object
container.name
Container name.
keyword
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
ecs.version
ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
keyword
event.dataset
Event dataset
constant_keyword
event.module
Event module
constant_keyword
host.architecture
Operating system architecture.
keyword
host.containerized
If the host is a container.
boolean
host.domain
Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
keyword
host.hostname
Hostname of the host. It normally contains what the hostname command returns on the host machine.
keyword
host.id
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.
keyword
host.ip
Host ip addresses.
ip
host.mac
Host mac addresses.
keyword
host.name
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
keyword
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
host.os.family
OS family (such as redhat, debian, freebsd, windows).
keyword
host.os.kernel
Operating system kernel version as a raw string.
keyword
host.os.name
Operating system name, without the version.
keyword
host.os.name.text
Multi-field of host.os.name.
text
host.os.platform
Operating system platform (such centos, ubuntu, windows).
keyword
host.os.version
Operating system version as a raw string.
keyword
host.type
Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.
keyword
mysql.galera_status.apply.oooe
How often applier started write-set applying out-of-order (parallelization efficiency).
double
gauge
mysql.galera_status.apply.oool
How often write-set was so slow to apply that write-set with higher seqno's were applied earlier. Values closer to 0 refer to a greater gap between slow and fast write-sets.
double
gauge
mysql.galera_status.apply.window
Average distance between highest and lowest concurrently applied seqno.
double
gauge
mysql.galera_status.cert.deps_distance
Average distance between highest and lowest seqno value that can be possibly applied in parallel (potential degree of parallelization).
double
gauge
mysql.galera_status.cert.index_size
The number of entries in the certification index.
long
gauge
mysql.galera_status.cert.interval
Average number of transactions received while a transaction replicates.
double
gauge
mysql.galera_status.cluster.conf_id
Total number of cluster membership changes happened.
long
gauge
mysql.galera_status.cluster.size
Current number of members in the cluster.
long
gauge
mysql.galera_status.cluster.status
Status of this cluster component. That is, whether the node is part of a PRIMARY or NON_PRIMARY component.
keyword
mysql.galera_status.commit.oooe
How often a transaction was committed out of order.
double
gauge
mysql.galera_status.commit.window
Average distance between highest and lowest concurrently committed seqno.
long
gauge
mysql.galera_status.connected
If the value is OFF, the node has not yet connected to any of the cluster components. This may be due to misconfiguration. Check the error log for proper diagnostics.
keyword
mysql.galera_status.evs.evict
Lists the UUID's of all nodes evicted from the cluster. Evicted nodes cannot rejoin the cluster until you restart their mysqld processes.
keyword
mysql.galera_status.evs.state
Shows the internal state of the EVS Protocol.
keyword
mysql.galera_status.flow_ctl.paused
The fraction of time since the last FLUSH STATUS command that replication was paused due to flow control. In other words, how much the slave lag is slowing down the cluster.
double
gauge
mysql.galera_status.flow_ctl.paused_ns
The total time spent in a paused state measured in nanoseconds.
long
counter
mysql.galera_status.flow_ctl.recv
Returns the number of FC_PAUSE events the node has received, including those the node has sent. Unlike most status variables, the counter for this one does not reset every time you run the query.
long
counter
mysql.galera_status.flow_ctl.sent
Returns the number of FC_PAUSE events the node has sent. Unlike most status variables, the counter for this one does not reset every time you run the query.
long
counter
mysql.galera_status.last_committed
The sequence number, or seqno, of the last committed transaction.
long
counter
mysql.galera_status.local.bf_aborts
Total number of local transactions that were aborted by slave transactions while in execution.
long
counter
mysql.galera_status.local.cert_failures
Total number of local transactions that failed certification test.
long
counter
mysql.galera_status.local.commits
Total number of local transactions committed.
long
counter
mysql.galera_status.local.recv.queue
Current (instantaneous) length of the recv queue.
long
gauge
mysql.galera_status.local.recv.queue_avg
Recv queue length averaged over interval since the last FLUSH STATUS command. Values considerably larger than 0.0 mean that the node cannot apply write-sets as fast as they are received and will generate a lot of replication throttling.
double
gauge
mysql.galera_status.local.recv.queue_max
The maximum length of the recv queue since the last FLUSH STATUS command.
long
gauge
mysql.galera_status.local.recv.queue_min
The minimum length of the recv queue since the last FLUSH STATUS command.
long
gauge
mysql.galera_status.local.replays
Total number of transaction replays due to asymmetric lock granularity.
long
gauge
mysql.galera_status.local.send.queue
Current (instantaneous) length of the send queue.
long
gauge
mysql.galera_status.local.send.queue_avg
Send queue length averaged over time since the last FLUSH STATUS command. Values considerably larger than 0.0 indicate replication throttling or network throughput issue.
double
gauge
mysql.galera_status.local.send.queue_max
The maximum length of the send queue since the last FLUSH STATUS command.
long
gauge
mysql.galera_status.local.send.queue_min
The minimum length of the send queue since the last FLUSH STATUS command.
long
gauge
mysql.galera_status.local.state
Internal Galera Cluster FSM state number.
keyword
mysql.galera_status.ready
Whether the server is ready to accept queries.
keyword
mysql.galera_status.received.bytes
Total size of write-sets received from other nodes.
long
counter
mysql.galera_status.received.count
Total number of write-sets received from other nodes.
long
counter
mysql.galera_status.repl.bytes
Total size of write-sets replicated.
long
counter
mysql.galera_status.repl.count
Total number of write-sets replicated (sent to other nodes).
long
counter
mysql.galera_status.repl.data_bytes
Total size of data replicated.
long
counter
mysql.galera_status.repl.keys
Total number of keys replicated.
long
counter
mysql.galera_status.repl.keys_bytes
Total size of keys replicated.
long
counter
mysql.galera_status.repl.other_bytes
Total size of other bits replicated.
long
counter
service.address
Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).
keyword
service.type
The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, service.type would be elasticsearch.
keyword

status

The MySQL status dataset collects data from MySQL by running a SHOW GLOBAL STATUS; SQL query. This query returns a large number of metrics.

An example event for status looks as following:

{
    "@timestamp": "2020-04-20T12:32:54.614Z",
    "mysql": {
        "status": {
            "max_used_connections": 3,
            "queries": 479,
            "handler": {
                "prepare": 0,
                "savepoint": 0,
                "update": 0,
                "delete": 0,
                "read": {
                    "rnd_next": 59604,
                    "first": 8,
                    "key": 6,
                    "last": 0,
                    "next": 1,
                    "prev": 0,
                    "rnd": 0
                },
                "rollback": 0,
                "write": 0,
                "commit": 5,
                "savepoint_rollback": 0,
                "external_lock": 552,
                "mrr_init": 0
            },
            "aborted": {
                "clients": 0,
                "connects": 0
            },
            "threads": {
                "running": 2,
                "cached": 1,
                "created": 3,
                "connected": 2
            },
            "flush_commands": 1,
            "created": {
                "tmp": {
                    "disk_tables": 0,
                    "files": 6,
                    "tables": 0
                }
            },
            "connections": 159,
            "command": {
                "insert": 0,
                "select": 155,
                "update": 0,
                "delete": 0
            },
            "opened_tables": 122,
            "binlog": {
                "cache": {
                    "use": 0,
                    "disk_use": 0
                }
            },
            "delayed": {
                "writes": 0,
                "errors": 0,
                "insert_threads": 0
            },
            "questions": 479,
            "innodb": {
                "buffer_pool": {
                    "read": {
                        "ahead_rnd": 0,
                        "requests": 1488,
                        "ahead": 0,
                        "ahead_evicted": 0
                    },
                    "pool": {
                        "wait_free": 0,
                        "reads": 405
                    },
                    "write_requests": 325,
                    "bytes": {
                        "data": 7176192,
                        "dirty": 0
                    },
                    "pages": {
                        "dirty": 0,
                        "flushed": 36,
                        "free": 7753,
                        "misc": 0,
                        "total": 8191,
                        "data": 438
                    }
                }
            },
            "bytes": {
                "received": 38468,
                "sent": 1622162
            },
            "open": {
                "streams": 0,
                "tables": 115,
                "files": 14
            }
        }
    },
    "event": {
        "dataset": "mysql.status",
        "module": "mysql",
        "duration": 4708776
    },
    "metricset": {
        "name": "status",
        "period": 10000
    },
    "ecs": {
        "version": "1.5.0"
    },
    "agent": {
        "id": "ede0be38-46a9-4ffc-8f1e-2ff9195193b6",
        "version": "8.0.0",
        "type": "metricbeat",
        "ephemeral_id": "4c773a2e-16d5-4d86-be49-cfb3573f4f4f",
        "hostname": "MacBook-Elastic.local"
    },
    "service": {
        "address": "127.0.0.1:3306",
        "type": "mysql"
    }
}

Exported fields

FieldDescriptionTypeMetric Type
@timestamp
Event timestamp.
date
agent.id
keyword
cloud.account.id
The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
keyword
cloud.availability_zone
Availability zone in which this host is running.
keyword
cloud.image.id
Image ID for the cloud instance.
keyword
cloud.instance.id
Instance ID of the host machine.
keyword
cloud.instance.name
Instance name of the host machine.
keyword
cloud.machine.type
Machine type of the host machine.
keyword
cloud.project.id
Name of the project in Google Cloud.
keyword
cloud.provider
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
keyword
cloud.region
Region in which this host is running.
keyword
container.id
Unique container id.
keyword
container.image.name
Name of the image the container was built on.
keyword
container.labels
Image labels.
object
container.name
Container name.
keyword
data_stream.dataset
Data stream dataset.
constant_keyword
data_stream.namespace
Data stream namespace.
constant_keyword
data_stream.type
Data stream type.
constant_keyword
ecs.version
ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.
keyword
event.dataset
Event dataset
constant_keyword
event.module
Event module
constant_keyword
host.architecture
Operating system architecture.
keyword
host.containerized
If the host is a container.
boolean
host.domain
Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
keyword
host.hostname
Hostname of the host. It normally contains what the hostname command returns on the host machine.
keyword
host.id
Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.
keyword
host.ip
Host ip addresses.
ip
host.mac
Host mac addresses.
keyword
host.name
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
keyword
host.os.build
OS build information.
keyword
host.os.codename
OS codename, if any.
keyword
host.os.family
OS family (such as redhat, debian, freebsd, windows).
keyword
host.os.kernel
Operating system kernel version as a raw string.
keyword
host.os.name
Operating system name, without the version.
keyword
host.os.name.text
Multi-field of host.os.name.
text
host.os.platform
Operating system platform (such centos, ubuntu, windows).
keyword
host.os.version
Operating system version as a raw string.
keyword
host.type
Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.
keyword
mysql.status.aborted.clients
The number of connections that were aborted because the client died without closing the connection properly.
long
counter
mysql.status.aborted.connects
The number of failed attempts to connect to the MySQL server.
long
counter
mysql.status.binlog.cache.disk_use
long
counter
mysql.status.binlog.cache.use
long
counter
mysql.status.bytes.received
The number of bytes received from all clients.
long
counter
mysql.status.bytes.sent
The number of bytes sent to all clients.
long
counter
mysql.status.cache.ssl.hits
The number of SSL session cache hits.
long
counter
mysql.status.cache.ssl.misses
The number of SSL session cache misses.
long
counter
mysql.status.cache.ssl.size
The SSL session cache size.
long
counter
mysql.status.cache.table.open_cache.hits
The number of hits for open tables cache lookups.
long
counter
mysql.status.cache.table.open_cache.misses
The number of misses for open tables cache lookups.
long
counter
mysql.status.cache.table.open_cache.overflows
Number of times, after a table is opened or closed, a cache instance has an unused entry and the size of the instance is larger than table_open_cache / table_open_cache_instances
long
counter
mysql.status.command.delete
The number of DELETE queries since startup.
long
counter
mysql.status.command.insert
The number of INSERT queries since startup.
long
counter
mysql.status.command.select
The number of SELECT queries since startup.
long
counter
mysql.status.command.update
The number of UPDATE queries since startup.
long
counter
mysql.status.connection.errors.accept
The number of errors that occurred during calls to accept() on the listening port.
long
counter
mysql.status.connection.errors.internal
The number of connections refused due to internal errors in the server, such as failure to start a new thread or an out-of-memory condition.
long
counter
mysql.status.connection.errors.max
The number of connections refused because the server max_connections limit was reached. thread or an out-of-memory condition.
long
counter
mysql.status.connection.errors.peer_address
The number of errors that occurred while searching for connecting client IP addresses.
long
counter
mysql.status.connection.errors.select
The number of errors that occurred during calls to select() or poll() on the listening port. (Failure of this operation does not necessarily means a client connection was rejected.)
long
counter
mysql.status.connection.errors.tcpwrap
The number of connections refused by the libwrap library.
long
counter
mysql.status.connections
long
counter
mysql.status.created.tmp.disk_tables
long
counter
mysql.status.created.tmp.files
long
counter
mysql.status.created.tmp.tables
long
counter
mysql.status.delayed.errors
long
counter
mysql.status.delayed.insert_threads
long
counter
mysql.status.delayed.writes
long
counter
mysql.status.flush_commands
long
counter
mysql.status.handler.commit
The number of internal COMMIT statements.
long
counter
mysql.status.handler.delete
The number of times that rows have been deleted from tables.
long
counter
mysql.status.handler.external_lock
The server increments this variable for each call to its external_lock() function, which generally occurs at the beginning and end of access to a table instance.
long
counter
mysql.status.handler.mrr_init
The number of times the server uses a storage engine's own Multi-Range Read implementation for table access.
long
counter
mysql.status.handler.prepare
A counter for the prepare phase of two-phase commit operations.
long
counter
mysql.status.handler.read.first
The number of times the first entry in an index was read.
long
counter
mysql.status.handler.read.key
The number of requests to read a row based on a key.
long
counter
mysql.status.handler.read.last
The number of requests to read the last key in an index.
long
counter
mysql.status.handler.read.next
The number of requests to read the next row in key order.
long
counter
mysql.status.handler.read.prev
The number of requests to read the previous row in key order.
long
counter
mysql.status.handler.read.rnd
The number of requests to read a row based on a fixed position.
long
counter
mysql.status.handler.read.rnd_next
The number of requests to read the next row in the data file.
long
counter
mysql.status.handler.rollback
The number of requests for a storage engine to perform a rollback operation.
long
counter
mysql.status.handler.savepoint
The number of requests for a storage engine to place a savepoint.
long
counter
mysql.status.handler.savepoint_rollback
The number of requests for a storage engine to roll back to a savepoint.
long
counter
mysql.status.handler.update
The number of requests to update a row in a table.
long
counter
mysql.status.handler.write
The number of requests to insert a row in a table.
long
counter
mysql.status.innodb.buffer_pool.bytes.data
The total number of bytes in the InnoDB buffer pool containing data.
long
counter
mysql.status.innodb.buffer_pool.bytes.dirty
The total current number of bytes held in dirty pages in the InnoDB buffer pool.
long
counter
mysql.status.innodb.buffer_pool.dump_status
The progress of an operation to record the pages held in the InnoDB buffer pool, triggered by the setting of innodb_buffer_pool_dump_at_shutdown or innodb_buffer_pool_dump_now.
long
counter
mysql.status.innodb.buffer_pool.load_status
The progress of an operation to warm up the InnoDB buffer pool by reading in a set of pages corresponding to an earlier point in time, triggered by the setting of innodb_buffer_pool_load_at_startup or innodb_buffer_pool_load_now.
long
counter
mysql.status.innodb.buffer_pool.pages.data
The number of pages in the InnoDB buffer pool containing data.
long
gauge
mysql.status.innodb.buffer_pool.pages.dirty
The current number of dirty pages in the InnoDB buffer pool.
long
gauge
mysql.status.innodb.buffer_pool.pages.flushed
The number of requests to flush pages from the InnoDB buffer pool.
long
gauge
mysql.status.innodb.buffer_pool.pages.free
The number of free pages in the InnoDB buffer pool.
long
gauge
mysql.status.innodb.buffer_pool.pages.latched
The number of latched pages in the InnoDB buffer pool.
long
gauge
mysql.status.innodb.buffer_pool.pages.misc
The number of pages in the InnoDB buffer pool that are busy because they have been allocated for administrative overhead, such as row locks or the adaptive hash index.
long
gauge
mysql.status.innodb.buffer_pool.pages.total
The total size of the InnoDB buffer pool, in pages.
long
gauge
mysql.status.innodb.buffer_pool.pool.reads
The number of logical reads that InnoDB could not satisfy from the buffer pool, and had to read directly from disk.
long
counter
mysql.status.innodb.buffer_pool.pool.resize_status
The status of an operation to resize the InnoDB buffer pool dynamically, triggered by setting the innodb_buffer_pool_size parameter dynamically.
long
counter
mysql.status.innodb.buffer_pool.pool.wait_free
Normally, writes to the InnoDB buffer pool happen in the background. When InnoDB needs to read or create a page and no clean pages are available, InnoDB flushes some dirty pages first and waits for that operation to finish. This counter counts instances of these waits.
long
counter
mysql.status.innodb.buffer_pool.read.ahead
The number of pages read into the InnoDB buffer pool by the read-ahead background thread.
long
gauge
mysql.status.innodb.buffer_pool.read.ahead_evicted
The number of pages read into the InnoDB buffer pool by the read-ahead background thread that were subsequently evicted without having been accessed by queries.
long
gauge
mysql.status.innodb.buffer_pool.read.ahead_rnd
The number of "random" read-aheads initiated by InnoDB.
long
gauge
mysql.status.innodb.buffer_pool.read.requests
The number of logical read requests.
long
gauge
mysql.status.innodb.buffer_pool.write_requests
The number of writes done to the InnoDB buffer pool.
long
counter
mysql.status.innodb.rows.deleted
The number of rows deleted into InnoDB tables.
long
counter
mysql.status.innodb.rows.inserted
The number of rows inserted into InnoDB tables.
long
counter
mysql.status.innodb.rows.reads
The number of rows reads into InnoDB tables.
long
counter
mysql.status.innodb.rows.updated
The number of rows updated into InnoDB tables.
long
counter
mysql.status.max_used_connections
long
counter
mysql.status.open.files
long
gauge
mysql.status.open.streams
long
gauge
mysql.status.open.tables
long
gauge
mysql.status.opened_tables
long
counter
mysql.status.queries
The number of statements executed by the server. This variable includes statements executed within stored programs, unlike the Questions variable. It does not count COM_PING or COM_STATISTICS commands.
long
counter
mysql.status.questions
The number of statements executed by the server. This includes only statements sent to the server by clients and not statements executed within stored programs, unlike the Queries variable. This variable does not count COM_PING, COM_STATISTICS, COM_STMT_PREPARE, COM_STMT_CLOSE, or COM_STMT_RESET commands.
long
counter
mysql.status.threads.cached
The number of cached threads.
long
gauge
mysql.status.threads.connected
The number of connected threads.
long
gauge
mysql.status.threads.created
The number of created threads.
long
gauge
mysql.status.threads.running
The number of running threads.
long
gauge
service.address
Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).
keyword
service.type
The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, service.type would be elasticsearch.
keyword

Changelog

VersionDetailsKibana version(s)

1.19.0

Enhancement View pull request
Enable secrets for sensitive fields. For more details, refer https://www.elastic.co/guide/en/fleet/current/agent-policy.html#agent-policy-secret-values

8.12.0 or higher

1.18.2

Bug fix View pull request
Disable secrets for older stack versions due to errors.

8.8.2 or higher

1.18.1

Bug fix View pull request
Add missing dimension to the performance datastream.

8.8.2 or higher

1.18.0

Enhancement View pull request
Enable 'secret' for the sensitive fields, supported from 8.12.

8.8.2 or higher

1.17.0

Enhancement View pull request
Add support for tags, processors and the preserve_original_event to the error and slowlog datastreams.

8.8.2 or higher

1.16.0

Enhancement View pull request
Update the package format_version to 3.0.0.

8.8.2 or higher

1.15.0

Enhancement View pull request
Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html.

8.8.2 or higher

1.14.0

Enhancement View pull request
Migrate Database Overview dashboard visualizations to lens.

8.8.0 or higher

1.13.0

Enhancement View pull request
Migrate Logs Overview dashboard visualizations to lens.

8.8.0 or higher

1.12.4

Bug fix View pull request
Fix to correct the aggregate function used in dashboard for fields having metric_type value counter.

8.8.0 or higher

1.12.3

Enhancement View pull request
Add dimensions for TSDB enablement for performance datastream.

8.8.0 or higher

1.12.2

Bug fix View pull request
Modifed the dimension field mapping to support public cloud deployment.

7.14.0 or higher
8.0.0 or higher

1.12.1

Enhancement View pull request
Add system test cases for performance datastream

7.14.0 or higher
8.0.0 or higher

1.12.0

Enhancement View pull request
Rename ownership from obs-service-integrations to obs-infraobs-integrations

7.14.0 or higher
8.0.0 or higher

1.11.0

Enhancement View pull request
Added system test cases for galera_status datastream

7.14.0 or higher
8.0.0 or higher

1.10.0

Enhancement View pull request
Add dimension fields to all status and gallera_status datastream to support TSDB enablement.

7.14.0 or higher
8.0.0 or higher

1.9.0

Enhancement View pull request
Added metric type mapping for galera_status datastream

7.14.0 or higher
8.0.0 or higher

1.8.0

Enhancement View pull request
Added metric type mapping for status datastream

7.14.0 or higher
8.0.0 or higher

1.7.0

Enhancement View pull request
Added metric type mapping for performance datastream

7.14.0 or higher
8.0.0 or higher

1.6.1

Enhancement View pull request
Added categories and/or subcategories.

—

1.6.0

Enhancement View pull request
Update ECS to 8.5.1

7.14.0 or higher
8.0.0 or higher

1.5.1

Bug fix View pull request
Update mysql slowlog pipeline to parse schema name with dash.

7.14.0 or higher
8.0.0 or higher

1.5.0

Enhancement View pull request
Update ingest pipeline for performance datastream.

7.14.0 or higher
8.0.0 or higher

1.4.0

Enhancement View pull request
Added infrastructure category.

7.14.0 or higher
8.0.0 or higher

1.3.2

Bug fix View pull request
Add Performance Config

7.14.0 or higher
8.0.0 or higher

1.3.1

Enhancement View pull request
Add documentation for multi-fields

7.14.0 or higher
8.0.0 or higher

1.3.0

Enhancement View pull request
Update to ECS 8.0

7.14.0 or higher
8.0.0 or higher

1.2.1

Bug fix View pull request
Change test public IPs to the supported subset

7.14.0 or higher
8.0.0 or higher

1.2.0

Enhancement View pull request
Release package for v8.0.0

—

1.1.1

Enhancement View pull request
Uniform with guidelines

7.14.0 or higher

1.1.0

Enhancement View pull request
Update to ECS 1.12.0

7.14.0 or higher

1.0.0

Enhancement View pull request
Release MySQL as GA

—

0.6.0

Enhancement View pull request
Update integration description

—

0.5.0

Bug fix View pull request
Fix logs overview dashboard

Enhancement View pull request
Release as beta

—

0.4.0

Enhancement View pull request
Sync latest changes from beats

Enhancement View pull request
Disable performance data stream by default in consistence with Beats

Enhancement View pull request
Enable ECS dependency

Enhancement View pull request
Set "event.module" and "event.dataset"

—

0.3.8

Enhancement View pull request
Updating package owner

—

0.3.7

Bug fix View pull request
Correct sample event file.

—

0.1.0

Enhancement View pull request
initial release

—

On this page