We are pleased to announce our first preview release for Logstash 6.0.0! Yes, you read that right! Six-dot-oh! There’s so much work going into this release, I can’t wait to show off all the shiny new features. But for this alpha, it’s all about the right foundation in place to ship those new features. Read on!
NOTE: Alpha releases cannot be used in production. They are for evaluation purposes only
Logstash Intermediate Representation
Currently, Logstash pipelines are declared in an imperative configuration language and then internally converted to a Ruby implementation. 6.0.0-alpha1 introduces an alternative graph based representation, mostly for internal use, called the Logstash Intermediate Representation (LIR). This format of the configuration allows for easier manipulation before runtime and then easier introspection during runtime. What does this mean to you, as a user? First off, the new format does not break existing configuration but works in conjunction. Secondly, with the LIR as a foundation, we can now implement new features such as pipeline viewer for your existing Logstash configuration. This will allow you to view and understand complex data flows from a higher level, but then quickly zoom in to identify plugins that are problematic. The pipeline viewer UI is still a work in progress, but I highly recommend watching our ElasticON presentation to get a preview of this feature.
Stay tuned for more updates in our alphas, but for now, we leave you with a teaser --
We've modified the GeoIP filter to support commercial databases. If you need access to ASN data in your lookups, you can buy and use the GeoIP2-ISP database from MaxMind with this filter.
We would love for you to try 6.0.0-alpha1 and let us know if you run into issues. As mentioned earlier, I'm really excited about new features that we can build on top of the LIR! 'til the next alpha!