Support SQL query for @timestamp field from logstash output
Failed to parse selected text as SQL query
BIND_PARAM clause is not supported
Since the log could be collected from logstash, it usually has the field @timestamp for the date and time value. But I couldn't query it with SQL query like normal date and time value as it will give this kind of error:
select *
from cloudtrail
where @timestamp == '2019-04-14T13:18:59.000Z' (on line 1, character 0)
1
vote
Muhammad Sukmana
shared this idea
-
This is already supported in Studio 3T. Given that the field name begins with a special character, the name must be quoted, see: https://studio3t.com/knowledge-base/articles/sql-query/#quoting-names-and-string-values
select *
from cloudtrail
where [@timestamp] = ‘2019-04-14T13:18:59.000Z’should work.
Thanks,
3T Team
