Starting from Logstash 8.0, the minimum required version of Java to run Logstash is Java 11. By default, Logstash will run with the bundled JDK, which has been verified to work with each specific version of Logstash, and generally provides the best performance and reliability.
See Breaking changes for a preview of additional breaking changes coming your way.
As processing times speed up, millisecond granularity is not always enough. Inbound data increasingly has sub-millisecond granularity timestamps. The pull request #12797 allows the internal mechanisms of Logstash that hold moment-in-time data - such as the Logstash Event, the Persistent Queue, the Dead Letter Queue and JSON encoding/decoding - to have nanosecond granularity.
Timestamp precision is limited to the JVM and Platform’s available granularity, which in many cases is microseconds.
This change also grants users access to Java time’s improved formatters, which include support fort ISO quarters, week-of-month, and a variety of timezone/offset-related format substitutions. For example:
filter {
mutate {
add_field => {"nanos" => "Nanos: %{{n}}" }
}
}
Results in the following event:
{
"@timestamp" => 2021-10-31T22:32:34.747968Z,
"host" => "logstash.lan",
"nanos" => "Nanos: 747968000",
"message" => "test",
"type" => "stdin",
"@version" => "1"
}