13 March 2018

Logstash Lines for 2018-03-13

By Andrew Cholakian

Hello fellow Logstashers! Here's what's new in Logstash for the past week. 

WIP of Inter-Pipeline Communications

Now that multiple pipelines exist, it's logical that users would want to connect them. #9225 describes the use cases in depth and is a (mostly) functional implementation of this concept. One tricky thing here is dealing with immutability of events in an efficient way. The PR contains a naive copy on write event cloning facility which will need to be improved before we can take this out of WIP. If this is an interesting feature to you, however, your feedback would be welcome!

Java Plugin API Design Discussions

We've been hard at work on the Java plugin API. There are a couple interesting design discussions and PoCs for those interested. You can track all these discussions, and progress in general, on #9215, which is the meta issue for this project.

Logstash Centralized Management now featured on Kibana home page

If you have a Gold or higher license, Logstash's Centralized Management feature will now show up on the Kibana home page. x-pack-kibana#4753 kibana#17027

Other stuff

  • Logstash-filter-dns - 3.0.8:  Fix bug where forward lookups would not cache timeout errors. logstash-filter-dns#41
  • logstash-input-tcp - 5.0.4: Update Netty/tc-native versions to match those in beats input logstash-input-beats#113
  • Logstash Monitoring charts have been patched in a recent merge to use the "max" aggregation for each timeseries bucket, instead of "avg". Using "avg" was trappy because it could mask major deviations, which might be interesting in a Monitoring context. 
  • The Pipeline Viewer is preparing to get a "config file" layout in addition to the current "graph" layout. To this end, a converter was written to convert the data structure behind the graph layout to one that will enable the config file layout. 
  • The Pipeline Viewer icons have been updated to use the latest Logstash icons defined in EUI. We were also able to reference the icon assets directly in EUI instead of copying them into monitoring; this helps with an initiative to get SVG assets out of the monitoring plugin.