- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Breaking changes
- Upgrading Logstash
- Configuring Logstash
- Performance Troubleshooting Guide
- Monitoring APIs
- Working with plugins
- Input plugins
- beats
- cloudwatch
- couchdb_changes
- drupal_dblog
- elasticsearch
- eventlog
- exec
- file
- ganglia
- gelf
- gemfire
- generator
- github
- graphite
- heartbeat
- heroku
- http
- http_poller
- imap
- irc
- jdbc
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- rackspace
- redis
- relp
- rss
- s3
- salesforce
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- zenoss
- zeromq
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- google_cloud_storage
- graphite
- graphtastic
- hipchat
- http
- influxdb
- irc
- jira
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- newrelic
- opentsdb
- pagerduty
- pipe
- rabbitmq
- rackspace
- redis
- redmine
- riak
- riemann
- s3
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- zeromq
- Filter plugins
- aggregate
- alter
- anonymize
- cidr
- cipher
- clone
- collate
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- i18n
- json
- json_encode
- kv
- metaevent
- metricize
- metrics
- mutate
- oui
- prune
- punct
- range
- ruby
- sleep
- split
- syslog_pri
- throttle
- tld
- translate
- urldecode
- useragent
- uuid
- xml
- yaml
- zeromq
- Codec plugins
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- Contributing a Patch to a Logstash Plugin
- Logstash Plugins Community Maintainer Guide
- Submitting your plugin to RubyGems.org and the logstash-plugins repository
- Glossary of Terms
- Release Notes
zeromq
editzeromq
editThis is a community-maintained plugin!
Write events to a 0MQ PUB socket.
You need to have the 0mq 2.1.x library installed to be able to use this output plugin.
The default settings will create a publisher connecting to a subscriber bound to tcp://127.0.0.1:2120
Synopsis
editThis plugin supports the following configuration options:
Required configuration options:
zeromq { topology => ... }
Available configuration options:
Details
edit
address
edit- Value type is array
-
Default value is
["tcp://127.0.0.1:2120"]
0mq socket address to connect or bind.
Please note that inproc://
will not work with logstashi.
For each we use a context per thread.
By default, inputs bind/listen and outputs connect.
codec
edit- Value type is codec
-
Default value is
"json"
The codec used for output data. Output codecs are a convenient method for encoding your data before it leaves the output, without needing a separate filter in your Logstash pipeline.
mode
edit-
Value can be any of:
server
,client
-
Default value is
"client"
Server mode binds/listens. Client mode connects.
sockopt
edit- Value type is hash
- There is no default value for this setting.
This exposes zmq_setsockopt for advanced tuning. See http://api.zeromq.org/2-1:zmq-setsockopt for details.
This is where you would set values like:
- ZMQ::HWM - high water mark
- ZMQ::IDENTITY - named queues
- ZMQ::SWAP_SIZE - space for disk overflow
Example:
sockopt => { "ZMQ::HWM" => 50 "ZMQ::IDENTITY" => "my_named_queue" }
topic
edit- Value type is string
-
Default value is
""
This is used for the pubsub topology only.
On inputs, this allows you to filter messages by topic.
On outputs, this allows you to tag a message for routing.
NOTE: ZeroMQ does subscriber-side filtering
NOTE: Topic is evaluated with event.sprintf
so macros are valid here.
topology
edit- This is a required setting.
-
Value can be any of:
pushpull
,pubsub
,pair
- There is no default value for this setting.
The default logstash topologies work as follows:
- pushpull - inputs are pull, outputs are push
- pubsub - inputs are subscribers, outputs are publishers
- pair - inputs are clients, inputs are servers
If the predefined topology flows don’t work for you, you can change the mode setting