It looks like it is working to me.
The time_stamp value from the previous run is being insert into the next statement by substitution.
Now you can increase the limit to 5
LIMIT 5 and let us verify that the fifth time_stamp is used in the statement on the next scheduled run.
Please verify that the contents of
/opt/elk/.logstash_jdbc_last_run is being updated after each scheduled run.
At this point you should check to ensure that the results are ordered by
time_stamp ascending, this is important to guarantee a continually increasing
time_stamp value (the assumption of the