# Postgresql queries in ELK **URL:** \ **Category:** Logstash\ **Created:** [November 23, 2020, 3:16pm UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371 "2020-11-23T15:16:17Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [November 23, 2020, 3:16pm UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/1 "2020-11-23T15:16:17Z")
Hi, I installed metricbeat to provide metrics from postgresql and it works, but main goal was to analize queries in elastic and build dashboard for custom queries. As I started to configure, any statements from database won't work. I saw that I should install plugin like jdbc to bring database queries to ELK ?. What is the best solution ? Thanks in advance for help. ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [November 23, 2020, 3:22pm UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/2 "2020-11-23T15:22:10Z")
Metricbeat will only collect metrics related to PostgreSQL instance health like CPU, memory, latency ... etc if you want to analyse Business data from postgresql database with kibana you should bring your postgresql data into elasticsearch with logstash using [jdbc input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-jdbc.html) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 23, 2020, 11:48pm UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/3 "2020-11-23T23:48:19Z")
If you are looking to analyse the actual queries that are run against your database, then check out Packetbeat and [https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-pgsql-options.html](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-pgsql-options.html) ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [November 24, 2020, 7:11am UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/4 "2020-11-24T07:11:37Z")
Ok, what is difference between jdbc with logstash and packetbeat ? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 24, 2020, 9:01am UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/5 "2020-11-24T09:01:30Z")
JDBC will take data from a table. Packetbeat builds session info out of the requests and responses. ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [November 24, 2020, 9:12am UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/6 "2020-11-24T09:12:27Z")
Thank you guys for help.There is any tutorial how it configure on docker ? I have elk on [https://github.com/deviantony/docker-elk#how-to-configure-logstash](https://github.com/deviantony/docker-elk#how-to-configure-logstash). I tried to configure jdbc based on [https://medium.com/@emreceylan/how-to-sync-postgresql-data-to-elasticsearch-572af15845ad](https://medium.com/@emreceylan/how-to-sync-postgresql-data-to-elasticsearch-572af15845ad) And I see in Stack Monitoring in Logstash section 1 node and 1 pipline but is "main" pipline not that I made for postgres to make test @ylasri @warkolm last logs from container with logstash logstash\_1 | [2020-11-24T14:34:43,203][INFO][logstash.javapipeline][.monitoring-logstash] Pipeline Java execution initialization time {"seconds"=\>0.83} logstash\_1 | [2020-11-24T14:34:43,235][INFO][logstash.javapipeline][.monitoring-logstash] Pipeline started {"pipeline.id"=\>".monitoring-logstash"} logstash\_1 | [2020-11-24T14:34:43,550][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} logstash\_1 | [2020-11-24T14:34:45,494][INFO][logstash.javapipeline] Pipeline terminated {"pipeline.id"=\>".monitoring-logstash"} logstash\_1 | [2020-11-24T14:34:45,589][INFO][logstash.runner] Logstash shut down. logstash\_1 | OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [November 30, 2020, 3:54pm UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/7 "2020-11-30T15:54:24Z")
Any tips how to install properly jdbc ? ---
**Author:** ![Charakterny](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Post date:** [December 2, 2020, 12:43pm UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/8 "2020-12-02T12:43:23Z")
Ok I downloaded jdbc for postgres, wrote logstash.conf but still won't work. My config of logstash.conf: input { jdbc { jdbc\_validate\_connection =\> "true" jdbc\_connection\_string =\> "jdbc:postgresql://x.x.x.x:xxxx/xxxx" jdbc\_driver\_library =\> "/usr/share/postgresql-42.2.18.jar" jdbc\_user =\> "xxx" jdbc\_password =\> "xxxxx" jdbc\_driver\_class =\> "org.postgresql.Driver" statement =\> "SELECT count(1) FROM sale\_or WHERE state = 'sale';" } } output { elasticsearch { hosts =\> "[http://elasticsearch](http://elasticsearch):xxxx" index =\> "jdbc" user =\> "xxxx" password =\> "xxxxxxx" } } Logs from container: [2020-12-02T12:37:04,859][INFO][logstash.monitoring.internalpipelinesource] Monitoring License OK [2020-12-02T12:37:04,861][INFO][logstash.monitoring.internalpipelinesource] Validated license for monitoring. Enabling monitoring pipeline. [2020-12-02T12:37:07,225][INFO][org.reflections.Reflections] Reflections took 224 ms to scan 1 urls, producing 22 keys and 45 values [2020-12-02T12:37:07,292][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", [A-Za-z0-9\_-], '"', "'", [A-Za-z\_], "-", [0-9], "[", "{" at line 19, column 36 (byte 269) after input {\n jdbc {\n jdbc\_connection\_string =\> ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge\_state'"]} OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. Any ideas ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 30, 2020, 12:43pm UTC](https://discuss.elastic.co/t/postgresql-queries-in-elk/256371/9 "2020-12-30T12:43:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.