- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Logstash Directory Layout
- Logstash Configuration Files
- logstash.yml
- Secrets keystore for secure settings
- Running Logstash from the Command Line
- Running Logstash as a Service on Debian or RPM
- Running Logstash on Docker
- Configuring Logstash for Docker
- Running Logstash on Windows
- Logging
- Shutting Down Logstash
- Installing X-Pack
- Setting Up X-Pack
- Upgrading Logstash
- Configuring Logstash
- Structure of a Config File
- Accessing Event Data and Fields in the Configuration
- Using Environment Variables in the Configuration
- Logstash Configuration Examples
- Multiple Pipelines
- Pipeline-to-Pipeline Communication (Beta)
- Reloading the Config File
- Managing Multiline Events
- Glob Pattern Support
- Converting Ingest Node Pipelines
- Logstash-to-Logstash Communication
- Centralized Pipeline Management
- X-Pack monitoring
- X-Pack security
- X-Pack Settings
- Managing Logstash
- Working with Logstash Modules
- Working with Filebeat Modules
- Data Resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Monitoring APIs
- Working with plugins
- Input plugins
- azure_event_hubs
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- jdbc
- jms
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- salesforce
- snmp
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- elastic_app_search
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- google_pubsub
- graphite
- graphtastic
- http
- influxdb
- irc
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- aggregate
- alter
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- http
- i18n
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- memcached
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- threats_classifier
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- xml
- Codec plugins
- Tips and Best Practices
- Troubleshooting Common Problems
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- How to write a Logstash output plugin
- Documenting your plugin
- Contributing a Patch to a Logstash Plugin
- Logstash Plugins Community Maintainer Guide
- Submitting your plugin to RubyGems.org and the logstash-plugins repository
- Contributing a Java Plugin
- Glossary of Terms
- Breaking Changes
- Release Notes
- Logstash 6.7.2 Release Notes
- Logstash 6.7.1 Release Notes
- Logstash 6.7.0 Release Notes
- Logstash 6.6.2 Release Notes
- Logstash 6.6.1 Release Notes
- Logstash 6.6.0 Release Notes
- Logstash 6.5.4 Release Notes
- Logstash 6.5.3 Release Notes
- Logstash 6.5.2 Release Notes
- Logstash 6.5.1 Release Notes
- Logstash 6.5.0 Release Notes
- Logstash 6.4.3 Release Notes
- Logstash 6.4.2 Release Notes
- Logstash 6.4.1 Release Notes
- Logstash 6.4.0 Release Notes
- Logstash 6.3.2 Release Notes
- Logstash 6.3.1 Release Notes
- Logstash 6.3.0 Release Notes
- Logstash 6.2.4 Release Notes
- Logstash 6.2.3 Release Notes
- Logstash 6.2.2 Release Notes
- Logstash 6.2.1 Release Notes
- Logstash 6.2.0 Release Notes
- Logstash 6.1.3 Release Notes
- Logstash 6.1.2 Release Notes
- Logstash 6.1.1 Release Notes
- Logstash 6.1.0 Release Notes
Offline Plugin Management
editOffline Plugin Management
editThe Logstash plugin manager provides support for preparing offline plugin packs that you can use to install Logstash plugins on systems that don’t have Internet access.
This procedure requires a staging machine running Logstash that has access to a public or private Rubygems server. The staging machine downloads and packages all the files and dependencies required for offline installation.
Building Offline Plugin Packs
editAn offline plugin pack is a compressed file that contains all the plugins your offline Logstash installation requires, along with the dependencies for those plugins.
To build an offline plugin pack:
- Make sure all the plugins that you want to package are installed on the staging server and that the staging server can access the Internet.
-
Run the
bin/logstash-plugin prepare-offline-pack
subcommand to package the plugins and dependencies:bin/logstash-plugin prepare-offline-pack --output OUTPUT [PLUGINS] --overwrite
where:
-
OUTPUT
specifies the zip file where the compressed plugin pack will be written. The default file is/LOGSTASH_HOME/logstash-offline-plugins-6.7.2.zip
. If you are using 5.2.x and 5.3.0, this location should be a zip file whose contents will be overwritten. -
[PLUGINS]
specifies one or more plugins that you want to include in the pack. -
--overwrite
specifies if you want to override an existing file at the location
-
Examples:
bin/logstash-plugin prepare-offline-pack logstash-input-beats bin/logstash-plugin prepare-offline-pack logstash-filter-* bin/logstash-plugin prepare-offline-pack logstash-filter-* logstash-input-beats
Packages the Beats input plugin and any dependencies. |
|
Uses a wildcard to package all filter plugins and any dependencies. |
|
Packages all filter plugins, the Beats input plugin, and any dependencies. |
Downloading all dependencies for the specified plugins may take some time, depending on the plugins listed.
Installing Offline Plugin Packs
editTo install an offline plugin pack:
- Move the compressed bundle to the machine where you want to install the plugins.
-
Run the
bin/logstash-plugin install
subcommand and pass in the file URI of the offline plugin pack.Windows example:
bin/logstash-plugin install file:///c:/path/to/logstash-offline-plugins-6.7.2.zip
Linux example:
bin/logstash-plugin install file:///path/to/logstash-offline-plugins-6.7.2.zip
This command expects a file URI, so make sure you use forward slashes and specify the full path to the pack.
Updating Offline Plugins
editTo update offline plugins, you update the plugins on the staging server and then use the same process that you followed to build and install the plugin pack:
-
On the staging server, run the
bin/logstash-plugin update
subcommand to update the plugins. See Updating plugins. - Create a new version of the plugin pack. See Building Offline Plugin Packs.
- Install the new version of the plugin pack. See Installing Offline Plugin Packs.