- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Logstash Directory Layout
- Logstash Configuration Files
- logstash.yml
- Secrets keystore for secure settings
- Running Logstash from the Command Line
- Running Logstash as a Service on Debian or RPM
- Running Logstash on Docker
- Configuring Logstash for Docker
- Running Logstash on Windows
- Logging
- Shutting Down Logstash
- Installing X-Pack
- Setting Up X-Pack
- Breaking Changes
- Upgrading Logstash
- Configuring Logstash
- Structure of a Config File
- Accessing Event Data and Fields in the Configuration
- Using Environment Variables in the Configuration
- Logstash Configuration Examples
- Multiple Pipelines
- Pipeline-to-Pipeline Communication (Beta)
- Reloading the Config File
- Managing Multiline Events
- Glob Pattern Support
- Converting Ingest Node Pipelines
- Logstash-to-Logstash Communication
- Centralized Pipeline Management
- X-Pack monitoring
- X-Pack security
- X-Pack Settings
- Managing Logstash
- Working with Logstash Modules
- Working with Filebeat Modules
- Data Resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Monitoring APIs
- Working with plugins
- Input plugins
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- jdbc
- jms
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- salesforce
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- graphite
- graphtastic
- http
- influxdb
- irc
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- aggregate
- alter
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- i18n
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- xml
- Codec plugins
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- Contributing a Patch to a Logstash Plugin
- Logstash Plugins Community Maintainer Guide
- Submitting your plugin to RubyGems.org and the logstash-plugins repository
- Glossary of Terms
- Release Notes
- Logstash 6.3.2 Release Notes
- Logstash 6.3.1 Release Notes
- Logstash 6.3.0 Release Notes
- Logstash 6.2.4 Release Notes
- Logstash 6.2.3 Release Notes
- Logstash 6.2.2 Release Notes
- Logstash 6.2.1 Release Notes
- Logstash 6.2.0 Release Notes
- Logstash 6.1.3 Release Notes
- Logstash 6.1.2 Release Notes
- Logstash 6.1.1 Release Notes
- Logstash 6.1.0 Release Notes
Input plugins
editInput plugins
editAn input plugin enables a specific source of events to be read by Logstash.
The following input plugins are available below. For a list of Elastic supported plugins, please consult the Support Matrix.
Plugin |
Description |
Github repository |
Receives events from the Elastic Beats framework |
||
Pulls events from the Amazon Web Services CloudWatch API |
||
Streams events from CouchDB’s |
||
read events from Logstash’s dead letter queue |
||
Reads query results from an Elasticsearch cluster |
||
Captures the output of a shell command as an event |
||
Streams events from files |
||
Reads Ganglia packets over UDP |
||
Reads GELF-format messages from Graylog2 as events |
||
Generates random log events for test purposes |
||
Reads events from a GitHub webhook |
||
Consume events from a Google Cloud PubSub service |
||
Reads metrics from the |
||
Generates heartbeat events for testing |
||
Receives events over HTTP or HTTPS |
||
Decodes the output of an HTTP API into events |
||
Reads mail from an IMAP server |
||
Reads events from an IRC server |
||
Creates events from JDBC data |
||
Reads events from a Jms Broker |
||
Retrieves metrics from remote Java applications over JMX |
||
Reads events from a Kafka topic |
||
Receives events through an AWS Kinesis stream |
||
Reads events over a TCP socket from a Log4j |
||
Receives events using the Lumberjack protocl |
||
Captures the output of command line tools as an event |
||
Streams events from a long-running command pipe |
||
Receives facts from a Puppet server |
||
Pulls events from a RabbitMQ exchange |
||
Reads events from a Redis instance |
||
Receives RELP events over a TCP socket |
||
Captures the output of command line tools as an event |
||
Streams events from files in a S3 bucket |
||
Creates events based on a Salesforce SOQL query |
||
Creates events based on SNMP trap messages |
||
Creates events based on rows in an SQLite database |
||
Pulls events from an Amazon Web Services Simple Queue Service queue |
||
Reads events from standard input |
||
Creates events received with the STOMP protocol |
||
Reads syslog messages as events |
||
Reads events from a TCP socket |
||
Reads events from the Twitter Streaming API |
||
Reads events over UDP |
||
Reads events over a UNIX socket |
||
Reads from the |
||
Reads events from a websocket |
||
Creates events based on the results of a WMI query |
||
Receives events over the XMPP/Jabber protocol |