Input plugins

An input plugin enables a specific source of events to be read by Logstash.

The following input plugins are available:

Plugin

Description

Github repository

beats

Receives events from the Elastic Beats framework

logstash-input-beats

couchdb_changes

Streams events from CouchDB’s _changes URI

logstash-input-couchdb_changes

drupal_dblog

Retrieves watchdog log events from Drupal installations with DBLog enabled

logstash-input-drupal_dblog

elasticsearch

Reads query results from an Elasticsearch cluster

logstash-input-elasticsearch

exec

Captures the output of a shell command as an event

logstash-input-exec

eventlog

Pulls events from the Windows Event Log

logstash-input-eventlog

file

Streams events from files

logstash-input-file

ganglia

Reads Ganglia packets over UDP

logstash-input-ganglia

gelf

Reads GELF-format messages from Graylog2 as events

logstash-input-gelf

generator

Generates random log events for test purposes

logstash-input-generator

graphite

Reads metrics from the graphite tool

logstash-input-graphite

github

Reads events from a GitHub webhook

logstash-input-github

heartbeat

Generates heartbeat events for testing

logstash-input-heartbeat

heroku

Streams events from the logs of a Heroku app

logstash-input-heroku

http

Receives events over HTTP or HTTPS

logstash-input-http

http_poller

Decodes the output of an HTTP API into events

logstash-input-http_poller

irc

Reads events from an IRC server

logstash-input-irc

imap

Reads mail from an IMAP server

logstash-input-imap

jdbc

Creates events from JDBC data

logstash-input-jdbc

jmx

Retrieves metrics from remote Java applications over JMX

logstash-input-jmx

kafka

Reads events from a Kafka topic

logstash-input-kafka

log4j

Reads events over a TCP socket from a Log4j SocketAppender object

logstash-input-log4j

lumberjack

Receives events using the Lumberjack protocl

logstash-input-lumberjack

meetup

Captures the output of command line tools as an event

logstash-input-meetup

pipe

Streams events from a long-running command pipe

logstash-input-pipe

puppet_facter

Receives facts from a Puppet server

logstash-input-puppet_facter

relp

Receives RELP events over a TCP socket

logstash-input-relp

rss

Captures the output of command line tools as an event

logstash-input-rss

rackspace

Receives events from a Rackspace Cloud Queue service

logstash-input-rackspace

rabbitmq

Pulls events from a RabbitMQ exchange

logstash-input-rabbitmq

redis

Reads events from a Redis instance

logstash-input-redis

salesforce

Creates events based on a Salesforce SOQL query

logstash-input-salesforce

snmptrap

Creates events based on SNMP trap messages

logstash-input-snmptrap

stdin

Reads events from standard input

logstash-input-stdin

sqlite

Creates events based on rows in an SQLite database

logstash-input-sqlite

s3

Streams events from files in a S3 bucket

logstash-input-s3

sqs

Pulls events from an Amazon Web Services Simple Queue Service queue

logstash-input-sqs

stomp

Creates events received with the STOMP protocol

logstash-input-stomp

syslog

Reads syslog messages as events

logstash-input-syslog

tcp

Reads events from a TCP socket

logstash-input-tcp

twitter

Reads events from the Twitter Streaming API

logstash-input-twitter

unix

Reads events over a UNIX socket

logstash-input-unix

udp

Reads events over UDP

logstash-input-udp

varnishlog

Reads from the varnish cache shared memory log

logstash-input-varnishlog

wmi

Creates events based on the results of a WMI query

logstash-input-wmi

websocket

Reads events from a websocket

logstash-input-websocket

xmpp

Receives events over the XMPP/Jabber protocol

logstash-input-xmpp

zenoss

Reads Zenoss events from the fanout exchange

logstash-input-zenoss

zeromq

Reads events from a ZeroMQ SUB socket

logstash-input-zeromq