postgres-to-sentinel.conf

# file: postgres-to-sentinel.conf
input {
    jdbc {
        # Postgres jdbc connection string to our database, mydb
        jdbc_connection_string => "jdbc:postgresql://localhost:5432/security"
        # The user we wish to execute our statement as
        jdbc_user => "lutsdbuser"
        # The user we wish to execute our statement as
        jdbc_password => "<YOUR PASSWORD>"
        # The path to our downloaded jdbc driver
        jdbc_driver_library => "/usr/share/logstash/modules/postgres/postgresql-42.2.12.jar"
        # The name of the driver class for Postgresql
        jdbc_driver_class => "org.postgresql.Driver"
        # postgres query with column tracking to avoid importing duplicates
        statement => "SELECT uid, timestamp, event, message, username, ipaddress FROM authentications WHERE uid > :sql_last_value"
		use_column_value => true
		tracking_column => "uid"
		# schedule to run every 5 minutes
		schedule => "*/5 * * * *"
    }
}
output {
    azure_loganalytics {
        customer_id => "814ff39f-2464-4d12-8c3f-af9233bddb98"
        shared_key => "<YOUR SHARED KEY>"
        log_type => "postgreSQLauthentications"
        key_names  => ['timestamp','event','message','username','ipaddress']
        flush_items => 10
        flush_interval_time => 5
    }
	# for debug
    stdout { codec => rubydebug }
}