# Snowflake to Elasticsearch

**URL:** <https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543>\
**Category:** Logstash\
**Created:** [November 20, 2023, 2:52pm UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543 "2023-11-20T14:52:08Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [November 20, 2023, 2:52pm UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/1 "2023-11-20T14:52:08Z")

</div>

Hi Team ,

We are trying to pull data from Snowflake database to Elasticsaerch via Logstash JDBC plugin

Input Config:

```auto
input {
  jdbc {
    jdbc_driver_library => "/usr/share/logstash/logstash-core/lib/jars/snowflake-jdbc-3.9.2.jar"
    jdbc_driver_class => "com.snowflake.client.jdbc.SnowflakeDriver"
    jdbc_connection_string => "jdbc:snowflake://xxx.snowflakecomputing.com/
	?db=PROD_abc&warehouse=PRODwH"
    jdbc_user => "username"
    jdbc_password => " *******"
    jdbc_paging_enabled => true
    jdbc_page_size => 100000
    schedule => "* * * * *"
    statement => "SELECT * FROM tablename LIMIT 10;"
    last_run_metadata_path => "/data/lib/logstash/snowflake/production/logstash_auditLog_snowflake_access_history.yml"
    jdbc_fetch_size => 1000
  }
}

```

But we get error like below :

```auto
[2023-11-20T08:58:04,520][ERROR][logstash.inputs.jdbc]
[snowflake_Pipeline][031fd8304bf1982583b766517b52ba1718eee5c7780a8e76345ef06ba3ae38bc]
 Unable to connect to database. Tried 1 times {:message=>"Java::JavaLang::ExceptionInInitializerError: ", 
:exception=>Sequel::DatabaseConnectionError, :cause=>java.lang.ExceptionInInitializerError,

```

Could you please advise on what can e checked here.

Thanks,  
Shalini.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 20, 2023, 5:00pm UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/2 "2023-11-20T17:00:44Z")

</div>

I would check:

- are params OK
- is port opened for the connection
- does jdbc connections work outside LS

---

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [November 21, 2023, 6:56am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/3 "2023-11-21T06:56:06Z")

</div>

Hi Rios ,

Please find inline comments

- are params OK - Snowflake team says its correct
- is port opened for the connection - Any specific ports to be opened ?
- does jdbc connections work outside LS - How to check that

Thanks,  
Shalini.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 21, 2023, 7:59am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/4 "2023-11-21T07:59:26Z")

</div>

Any specific ports to be opened?

- TCP 443 should be opened, if is working from the same host, then it's OK  
How to check that?
- curl  
curl -v -k [[https://xxx.snowflakecomputing.com](https://xxx.snowflakecomputing.com)]

And more:  
Does "logstash" have rights on "/usr/share/logstash/logstash-core/lib/jars/snowflake-jdbc-3.9.2.jar" ? There is always workaround to put snowflake-jdbc-3.9.2.jar in /etc/logstash/

---

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [November 21, 2023, 8:21am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/5 "2023-11-21T08:21:02Z")

</div>

Hi Rio ,

When I did : curl as below this is the response

```auto
curl -v -k xxx-xxx.snowflakecomputing.com
* Trying 3.124.148.227:80...
* TCP_NODELAY set
* Connected to xxx-xxx.snowflakecomputing.com (3.124.148.227) port 80 (#0)
> GET / HTTP/1.1
> Host: xxx-xxx.snowflakecomputing.com
> User-Agent: curl/7.65.0
> Accept: */*
>
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer

```

Permissions for snowflake jar is :

`-rwxr-xr-x. 1 root root 30625824 Nov 9 07:40 snowflake-jdbc-3.9.2.ja`r

---

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [November 22, 2023, 6:46am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/6 "2023-11-22T06:46:42Z")

</div>

Hi Rio ,

Permissions for snowflake jar is changed to Logstash from root.

Any suggestions ?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 23, 2023, 3:56am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/7 "2023-11-23T03:56:15Z")

</div>

> [@Shalinicts](#):
>
> `curl -v -k xxx-xxx.snowflakecomputing.com`

You should use port 443 not default  
`curl -v -k https://xxx-xxx.snowflakecomputing.com`

Also you might try similar

```auto
jdbc_connection_string => "jdbc:snowflake://xxx.snowflakecomputing.com:443/
	?db=PROD_abc&warehouse=PRODwH"

```

DatabaseConnectionError in general means there is no the network connection.  
Can you check on snowflake side and server and firewall, does your jdbc request is comming?

---

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [November 23, 2023, 7:47am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/8 "2023-11-23T07:47:42Z")

</div>

Hi Rio ,

```auto
curl -v -k https://xxx.snowflakecomputing.com
* Trying x.x.x.x:443...
* TCP_NODELAY set
* Connected to xxx-xxx.snowflakecomputing.com (x.x.x.x) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: none
  CApath: none
* loaded libnssckbi.so
* NSS error -5961 (PR_CONNECT_RESET_ERROR)
* TCP connection reset by peer
* Closing connection 0
curl: (35) TCP connection reset by peer

```

```auto
--------------------------------------------------------------------

```

```auto
telnet xxx.snowflakecomputing.com 443
Trying x.x.x.x...
Connected to xxx.snowflakecomputing.com.
Escape character is '^]'.

```

```auto

This is the results for curl and Telnet . Is this means it is connected?
```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 23, 2023, 8:14am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/9 "2023-11-23T08:14:57Z")

</div>

I would say on TCP level it is, the port has been opened.  
Maybe you have some restrictions on snowflake side like a network policy. Check with command:  
`SHOW NETWORK POLICIES;`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2023, 8:15am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch/347543/10 "2023-12-21T08:15:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
