07 February 2018

Logstash Lines for 2018-02-07

By Andrew Cholakian

The big news this week is of course that 6.2.0 is now live! Check out the blog post for details.

Let's now move on to non-release news...

Logstash Versioned Plugin Reference Now Live!

I'm very excited to announce that we now host the docs for every published version of every Logstash plugin in our new Versioned Plugin Reference! This is a key feature for users of older Logstashes, since they can now reference older docs. One thing we're still thinking through is how to link these to specific Logstash versions, since the plugin versions don't correlate. Currently the best way is to download that version and see which plugin version comes with it by looking in the Gemfile.lock.

Streaming JSON

One area of inefficiency and frustration is dealing with JSON. Logstash has a notion of both json_lines and json when it comes to decoding data. We had the idea of seeing if we could switch to Jackson's streaming mode to deal with JSON instead. This would, for most people, mean they wouldn't have to worry about that distinction when reading JSON, since a streaming parser would handle either situation.

This is in an early experimental phase, we're not entirely sure how this will look for the product, but it's something we're excited about, and a POC PR is open.

Other fixes

Syslog Input

Better syslog input compatibility with codecs that change the syslog field. #49

Allow syslog input to use custom groks to be more flexible: #47

Fluentd Codec

Improve fluent codec to encode message tags in a more standard way: #21

Mutate Filter

Handle EU comma style decimals: #115