MySQL, MariaDB, and SingleStore

Dialects that use these instructions

MySQL, MariaDB, and SingleStore (formerly MemSQL) share the database setup requirements that are described on this page for connecting Looker to your analytics database. To configure MySQL as the internal backend database for a customer-hosted Looker instance, see Migrating the Looker backend database to MySQL.

Encrypting network traffic

It is a best practice to encrypt network traffic between the Looker application and your database. Consider one of the options that are described on the Enabling secure database access documentation page.

If you're interested in using SSL encryption, see this MySQL documentation page.

Users and security

To create and grant the required access to the Looker user, follow the instructions in the section for your database dialect and version.

MySQL 8.4.X

In MySQL 8.4.X, the default authentication plugin is caching_sha2_password, and the mysql_native_password plugin is deactivated by default. Choose one of the following authentication methods depending on whether SSL is enabled for your Looker connection:

• When connecting with SSL enabled (recommended): The Looker JDBC driver supports caching_sha2_password over SSL connections without enabling mysql_native_password. Select SSL when you create the Looker connection, and run the following commands to create the user and grant SELECT privileges:

  CREATE USER 'DB_USERNAME'@'%' IDENTIFIED WITH caching_sha2_password BY 'PASSWORD';
  GRANT SELECT ON DATABASE_NAME.* TO 'DB_USERNAME'@'%';
  

• When connecting without SSL enabled: Because Looker doesn't enable automatic RSA public key retrieval (allowPublicKeyRetrieval) on unencrypted customer database connections, you must authenticate with mysql_native_password:

  1. Configure the MySQL 8.4.X server to enable the mysql_native_password plugin by using one of the following methods, depending on your deployment:

     • Start the MySQL server with the --mysql-native-password=ON flag.

     • Set the property in the my.cnf configuration file:

       [mysqld]
       mysql_native_password=ON
       

     • For cloud-hosted MySQL 8.4.X instances on Google Cloud, AWS, or Azure, enable the mysql_native_password database flag or parameter in your instance configuration or parameter group if it isn't enabled by default, and restart the database instance if required. See your cloud provider's documentation for configuration details.

  2. Create the database user with mysql_native_password and grant SELECT privileges:

     CREATE USER 'DB_USERNAME'@'%' IDENTIFIED WITH mysql_native_password BY 'PASSWORD';
     GRANT SELECT ON DATABASE_NAME.* TO 'DB_USERNAME'@'%';
     

Replace the following placeholders in the preceding commands:

• DB_USERNAME: the username for the Looker database user, such as looker
• PASSWORD: a unique, secure password
• DATABASE_NAME: the name of your database

MySQL 8.0.X

In MySQL 8.0.X, the default authentication plugin is caching_sha2_password. Looker uses the mysql_native_password plugin to authenticate to MySQL 8.0.X databases through the JDBC driver. For MySQL 8.0.X to work properly, complete the following steps:

1. Configure the MySQL database to use the mysql_native_password plugin. This can be done in multiple ways, and will depend on how your MySQL 8 database is deployed and what type of access you have to the configuration:

   • Start the process with the flag --default-auth=mysql_native_password

   • Set the property in the my.cnf configuration file:

   [mysqld]
   default-authentication-plugin=mysql_native_password
   

   • If your database instance is hosted through AWS RDS, set the default_authentication_plugin parameter through an RDS Parameter Group that is applied to this database instance.

2. Run the following commands, replacing PASSWORD with a unique, secure password:

   CREATE USER looker IDENTIFIED WITH mysql_native_password BY 'PASSWORD';
   GRANT SELECT ON database_name.* TO 'looker'@'%';
   

MySQL 5.7.X and earlier, MariaDB, and SingleStore:

Run the following commands, replacing PASSWORD with a unique, secure password:

CREATE USER looker;
SET PASSWORD FOR looker = PASSWORD ('PASSWORD');
GRANT SELECT ON database_name.* TO 'looker'@'%';

Temp schema setup for persistent derived tables

These database dialects support the creation of persistent derived tables (PDTs). This feature can be very useful, and we recommend enabling it when possible.

To enable PDTs, you need to configure a temp schema. The following commands show an example of creating a temp database and granting the required privileges to the looker user.

You can specify the name of the temp database in the Temp Database field when creating your database connection. If you don't specify a temp database name, Looker generates a scratch database named looker_tmp. The following commands use looker_tmp, but if you specified a different temp database name, use your temp database name instead of looker_tmp.

CREATE SCHEMA looker_tmp;
GRANT
  SELECT,
  INDEX,
  INSERT,
  UPDATE,
  DELETE,
  CREATE,
  DROP,
  ALTER,
  CREATE TEMPORARY TABLES
ON looker_tmp.* TO 'looker'@'%';

For SingleStore, or if your database uses GTID-based replication, you must use the create_process LookML parameter to use PDTs, because GTID does not support CREATE TABLE AS SELECT statements.

Alternative setup for regular derived tables

If you don't want to allow the creation of persistent derived tables, you can still use regular derived tables. To use regular derived tables, you still need to add certain permissions to a schema called looker_tmp. However, the looker_tmp schema does not actually need to exist in your database!

GRANT
  SELECT,
  INDEX,
  INSERT,
  DROP,
  CREATE TEMPORARY TABLES
ON looker_tmp.* TO 'looker'@'%';
-- Note that the looker_tmp schema does not need to actually exist,
-- even though these permission grants are still needed

Setting the max_allowed_packet variable

For MySQL, set the MySQL max_allowed_packet variable to its maximum value, 1073741824, to prevent "SQLException: Packet for query is too large" errors.

Creating the Looker connection to your database

After completing the database configuration, you can connect to the database from Looker. Follow these steps to create the connection from Looker to your database:

1. In the Admin section of Looker, select Connections, and then click Add Connection.

2. From the Dialect drop-down menu, select your database dialect name: MySQL, MySQL 8.0.12+ (for MySQL 8.0.12 and later 8.X versions, including MySQL 8.4.X), MariaDB, SingleStore, or SingleStore 7+.

3. Fill out the connection details. The majority of the settings are common to most database dialects. See the Connecting Looker to your database documentation page for information.

4. To verify that the connection is successful, click the Test Connection button in the Status details section at the bottom of the Connections Settings page.

5. If Looker displays Can Connect, press Connect to create the connection.

Your database connection is then added to the list on the Looker Connections Admin page.

Supported JDBC parameters

For MySQL, MariaDB, and SingleStore, Looker supports the following JDBC parameters in the Additional JDBC parameters field for the connection. See the documentation for your database for information on these parameters.

• allowMultiQueries
• autocommit
• characterSetResults
• clientCertificateKeyStorePassword
• clientCertificateKeyStoreUrl
• connectionAttributes
• connectionCollation
• connectionTimeZone
• connectTimeout
• defaultAuthenticationPlugin
• disableSslHostnameVerification
• disconnectOnExpiredPasswords
• enabledSslCipherSuites
• failOverReadOnly
• fallbackToSystemTrustStore
• forceConnectionTimeZoneToSession
• interactiveClient
• lookerFailover
• maxIdleTime
• maxQuerySizeToLog
• oldModeNoPrecisionTimestamp
• password
• passwordCharacterEncoding
• permitMysqlScheme
• pinGlobalTxToPhysicalConnection
• preserveInstants
• queryInterceptors
• restrictedAuth
• rewriteBatchedStatements
• socketTimeout
• sslMode
• tcpKeepAlive
• trustCertificateKeyStorePassword
• trustCertificateKeyStoreUrl
• useCompression
• usePipelineAuth
• user
• useServerPrepStmts
• verifyServerCertificate
• yearIsDateType

Feature support

For Looker to support some features, your database dialect must also support them.

MySQL supports the following features as of Looker 26.22:

MySQL 8.0.12+ supports the following features as of Looker 26.22:

MariaDB supports the following features as of Looker 26.22:

SingleStore supports the following features as of Looker 26.22:

SingleStore 7+ supports the following features as of Looker 26.22: