Logstash APIs
1.0

Base URL
http://api.example.com

When you run Logstash, it automatically captures runtime metrics that you can use to monitor the health and performance of your Logstash deployment. The metrics collected by Logstash include:

  • Health report.
  • Hot threads.
  • Logstash node info, like pipeline settings, OS info, and JVM info.
  • Node stats, like JVM stats, process stats, event-related stats, and pipeline runtime stats.
  • Plugins info, including a list of installed plugins.

The APIs that retrieve these metrics are available by default, with no extra configuration needed.

Documentation source and versions

This documentation is derived from the main branch of the logstash repository. It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.

This is version 1.0 of this API documentation. Last update on Apr 14, 2025.








Get hot threads

GET /_node/hot_threads

Get information about current hot threads for Logstash. A hot thread is a Java thread that has high CPU usage and takes longer than normal to execute.

Query parameters

  • threads integer

    The number of hot threads to return.

    Default value is 10.

  • stacktrace_size integer

    The depth of the stack trace to report for each thread.

    Default value is 50.

  • ignore_idle_threads boolean

    If true, does not return idle threads.

    Default value is true.

  • pretty boolean

    If you append ?pretty=true to the request, the JSON returned will be pretty formatted. Use it for debugging only!

  • human boolean

    If you append ?human=true to the request, the JSON returned will be in a human-readable format.

Responses

  • 200 application/json

    Indicates a successful call

    Hide response attribute Show response attribute object
    • hot_threads object
      Hide hot_threads attributes Show hot_threads attributes object
      • time string
      • busiest_threads integer
      • threads array[object]
        Hide threads attributes Show threads attributes object
        • name string
        • thread_id integer
        • percent_of_cpu_time number(double)
        • state string
        • traces array[string]
GET /_node/hot_threads
curl \
 --request GET 'http://api.example.com/_node/hot_threads' \
 --user "username:password"
Response examples (200)
{
  "hot_threads": {
    "time": "2025-01-06T18:25:28-07:00",
    "threads": [
      {
        "name": "Ruby-0-Thread-7",
        "state": "timed_waiting",
        "traces": [
          "java.lang.Object.wait(Native Method)",
          "org.jruby.RubyThread.sleep(RubyThread.java:1002)",
          "org.jruby.RubyKernel.sleep(RubyKernel.java:803)"
        ],
        "thread_id": 37,
        "percent_of_cpu_time": 0.0
      },
      {
        "name": "[test2]>worker3",
        "state": "waiting",
        "traces": [
          "sun.misc.Unsafe.park(Native Method)",
          "java.util.concurrent.locks.LockSupport.park(LockSupport.java:175)",
          "java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(AbstractQueuedSynchronizer.java:836)"
        ],
        "thread_id": 10,
        "percent_of_cpu_time": 0.85
      },
      {
        "name": "[test2]>worker2",
        "state": "runnable",
        "traces": [
          "org.jruby.RubyClass.allocate(RubyClass.java:225)",
          "org.jruby.RubyClass.newInstance(RubyClass.java:856)",
          "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)"
        ],
        "thread_id": 11,
        "percent_of_cpu_time": 0.85
      }
    ],
    "busiest_threads": 3
  }
}

Node info

Logstash node info, like pipeline settings, OS info, and JVM info.









Get settings for pipelines

GET /_node/pipelines

Get information and settings for all pipelines.

Query parameters

  • pretty boolean

    If you append ?pretty=true to the request, the JSON returned will be pretty formatted. Use it for debugging only!

Responses

  • 200 application/json

    Indicates a successful call

    Hide response attribute Show response attribute object
    • pipelines object
      Hide pipelines attribute Show pipelines attribute object
      • * object Additional properties
        Hide * attributes Show * attributes object
        • workers integer
        • batch_size integer
        • batch_delay integer
        • config_reload_automatic boolean
        • config_reload_interval integer
        • dead_letter_queue_enabled boolean
GET /_node/pipelines
curl \
 --request GET 'http://api.example.com/_node/pipelines' \
 --user "username:password"
Response examples (200)
{
  "pipelines": {
    "ingestion-pipeline": {
      "workers": 8,
      "batch_size": 125,
      "batch_delay": 5,
      "config_reload_interval": 3,
      "config_reload_automatic": false,
      "dead_letter_queue_enabled": false
    },
    "aggregation-pipeline": {
      "workers": 1,
      "batch_size": 125,
      "batch_delay": 50,
      "config_reload_interval": 3,
      "config_reload_automatic": false,
      "dead_letter_queue_enabled": false
    }
  }
}

Get settings for a pipeline

GET /_node/pipelines/{pipeline_name}

Get information and settings for all pipelines.

Path parameters

  • pipeline_name string Required

    The name of the pipeline to retrieve information for.

Query parameters

  • pretty boolean

    If you append ?pretty=true to the request, the JSON returned will be pretty formatted. Use it for debugging only!

Responses

  • 200 application/json

    Indicates a successful call

    Hide response attribute Show response attribute object
    • pipelines object
      Hide pipelines attribute Show pipelines attribute object
      • * object Additional properties
        Hide * attributes Show * attributes object
        • workers integer
        • batch_size integer
        • batch_delay integer
        • config_reload_automatic boolean
        • config_reload_interval integer
        • dead_letter_queue_enabled boolean
GET /_node/pipelines/{pipeline_name}
curl \
 --request GET 'http://api.example.com/_node/pipelines/{pipeline_name}' \
 --user "username:password"
Response examples (200)
{
  "pipelines": {
    "aggregation-pipeline": {
      "workers": 1,
      "batch_size": 125,
      "batch_delay": 50,
      "config_reload_interval": 3,
      "config_reload_automatic": false,
      "dead_letter_queue_enabled": false
    }
  }
}





Get events statistics

GET /_node/stats/events

Get statistics related to event processing.

Query parameters

  • pretty boolean

    If you append ?pretty=true to the request, the JSON returned will be pretty formatted. Use it for debugging only!

Responses

  • 200 application/json

    A JSON object containing events statistics.

    Hide response attribute Show response attribute object
    • events object
      Hide events attributes Show events attributes object
      • in integer(int64)
      • filtered integer(int64)
      • out integer(int64)
      • duration_in_millis integer(int64)
      • queue_push_duration_in_millis integer(int64)
GET /_node/stats/events
curl \
 --request GET 'http://api.example.com/_node/stats/events' \
 --user "username:password"
Response examples (200)
{
  "events": {
    "in": 56,
    "out": 56,
    "filtered": 56,
    "duration_in_millis": 1109,
    "queue_push_duration_in_millis": 2
  }
}
















Get statistics for pipelines

GET /_node/stats/pipelines

Get pipeline performance metrics and plugin details.

Query parameters

  • pretty boolean

    If you append ?pretty=true to the request, the JSON returned will be pretty formatted. Use it for debugging only!

Responses

GET /_node/stats/pipelines
curl \
 --request GET 'http://api.example.com/_node/stats/pipelines' \
 --user "username:password"
Response examples (200)
{
  "pipelines": {
    "beats-es": {
      "flow": {
        "input_throughput": {
          "current": 603.1,
          "lifetime": 575.4
        },
        "filter_throughput": {
          "current": 604.2,
          "lifetime": 575.1
        },
        "output_throughput": {
          "current": 604.8,
          "lifetime": 575.1
        },
        "queue_backpressure": {
          "current": 0.214,
          "lifetime": 0.937
        },
        "worker_concurrency": {
          "current": 0.941,
          "lifetime": 0.9709
        },
        "worker_utilization": {
          "current": 93.092,
          "lifetime": 92.187
        }
      },
      "queue": {
        "type": "memory"
      },
      "events": {
        "in": 216610,
        "out": 216485,
        "filtered": 216485,
        "duration_in_millis": 365495,
        "queue_push_duration_in_millis": 342466
      },
      "plugins": {
        "inputs": [
          {
            "id": "35131f351e2dc5ed13ee04265a8a5a1f95292165-1",
            "flow": {
              "throughput": {
                "current": 603.1,
                "lifetime": 590.7
              }
            },
            "name": "beats",
            "events": {
              "out": 216485,
              "queue_push_duration_in_millis": 342466
            }
          }
        ],
        "filters": [
          {
            "id": "35131f351e2dc5ed13ee04265a8a5a1f95292165-2",
            "flow": {
              "worker_utilization": {
                "current": 16.71,
                "lifetime": 15.27
              },
              "worker_millis_per_event": {
                "current": 2829,
                "lifetime": 0.2585
              }
            },
            "name": "grok",
            "events": {
              "in": 216485,
              "out": 216485,
              "duration_in_millis": 55969
            },
            "failures": 216485,
            "patterns_per_field": {
              "message": 1
            }
          },
          {
            "id": "35131f351e2dc5ed13ee04265a8a5a1f95292165-3",
            "flow": {
              "worker_utilization": {
                "current": 1.042,
                "lifetime": 0.9076
              },
              "worker_millis_per_event": {
                "current": 0.01763,
                "lifetime": 0.01536
              }
            },
            "name": "geoip",
            "events": {
              "in": 216485,
              "out": 216485,
              "duration_in_millis": 3326
            }
          }
        ],
        "outputs": [
          {
            "id": "35131f351e2dc5ed13ee04265a8a5a1f95292165-4",
            "flow": {
              "worker_utilization": {
                "current": 75.34,
                "lifetime": 76.01
              },
              "worker_millis_per_event": {
                "current": 1.276,
                "lifetime": 1.287
              }
            },
            "name": "elasticsearch",
            "events": {
              "in": 216485,
              "out": 216485,
              "duration_in_millis": 278557
            }
          }
        ]
      },
      "reloads": {
        "failures": 0,
        "successes": 0,
        "last_error": null,
        "last_failure_timestamp": null,
        "last_success_timestamp": null
      },
      "pipeline": {
        "workers": 4,
        "batch_size": 125,
        "batch_delay": 50
      }
    },
    "heartbeat-ruby-stdout": {
      "flow": {
        "input_throughput": {
          "current": 0,
          "lifetime": 0.0167,
          "last_1_minute": 0.01614,
          "last_5_minutes": 0.01627,
          "last_15_minutes": 0.01643
        },
        "filter_throughput": {
          "current": 0,
          "lifetime": 0.0167,
          "last_1_minute": 0.01614,
          "last_5_minutes": 0.01627,
          "last_15_minutes": 0.01643
        },
        "output_throughput": {
          "current": 0,
          "lifetime": 0.0167,
          "last_1_minute": 0.01614,
          "last_5_minutes": 0.01627,
          "last_15_minutes": 0.01643
        },
        "queue_backpressure": {
          "current": 0,
          "lifetime": 5.901e-05,
          "last_1_minute": 1.614e-05,
          "last_5_minutes": 2.278e-05,
          "last_15_minutes": 4.272e-05
        },
        "worker_concurrency": {
          "current": 0,
          "lifetime": 0.0001266,
          "last_1_minute": 4.843e-05,
          "last_5_minutes": 7.486e-05,
          "last_15_minutes": 0.0001183
        },
        "worker_utilization": {
          "current": 0,
          "lifetime": 0.001055,
          "last_1_minute": 0.0004036,
          "last_5_minutes": 0.0006239,
          "last_15_minutes": 0.0009858
        },
        "queue_persisted_growth_bytes": {
          "current": 0,
          "lifetime": 4.214,
          "last_1_minute": 4.068,
          "last_5_minutes": 4.101,
          "last_15_minutes": 4.14
        },
        "queue_persisted_growth_events": {
          "current": 0,
          "lifetime": 0,
          "last_1_minute": 0,
          "last_5_minutes": 0,
          "last_15_minutes": 0
        }
      },
      "hash": "c11e0502ebf98956dffa371775fd1cb719f85f819ee166b770b3e982da1c999d",
      "queue": {
        "data": {
          "path": "/path/to/logstash/data/queue/heartbeat-ruby-stdout",
          "storage_type": "apfs",
          "free_space_in_bytes": 60833390592
        },
        "type": "persisted",
        "events": 0,
        "capacity": {
          "max_unread_events": 0,
          "queue_size_in_bytes": 11341,
          "page_capacity_in_bytes": 67108864,
          "max_queue_size_in_bytes": 1073741824
        },
        "events_count": 0,
        "queue_size_in_bytes": 11341,
        "max_queue_size_in_bytes": 1073741824
      },
      "events": {
        "in": 45,
        "out": 45,
        "filtered": 45,
        "duration_in_millis": 341,
        "queue_push_duration_in_millis": 159
      },
      "plugins": {
        "codecs": [
          {
            "id": "plain_b0090202-daac-428e-8355-18c35a0826cb",
            "name": "plain",
            "decode": {
              "out": 0,
              "writes_in": 0,
              "duration_in_millis": 0
            },
            "encode": {
              "writes_in": 0,
              "duration_in_millis": 0
            }
          },
          {
            "id": "6bff4bc6-3a8c-494c-aa65-d16e1eb09578",
            "name": "rubydebug"
          }
        ],
        "inputs": [
          {
            "id": "c9ca46e359d73146590ca8af40092342afa922f3cbf07adc4b5009e346cb19f7",
            "flow": {
              "throughput": {
                "current": 0,
                "lifetime": 0.0167,
                "last_1_minute": 0.01614,
                "last_5_minutes": 0.01627,
                "last_15_minutes": 0.01643
              }
            },
            "name": "heartbeat",
            "events": {
              "out": 45,
              "queue_push_duration_in_millis": 159
            }
          }
        ],
        "filters": [
          {
            "id": "585fa932a4fd506055ead07ee5ebcb3033c27c82ba90cbee73d6ac7e9357333a",
            "flow": {
              "worker_utilization": {
                "current": 0,
                "lifetime": 0.000266,
                "last_1_minute": 0.0001345,
                "last_5_minutes": 0.0001627,
                "last_15_minutes": 0.0002191
              },
              "worker_millis_per_event": {
                "lifetime": 1.911,
                "last_1_minute": 1,
                "last_5_minutes": 1.2,
                "last_15_minutes": 1.6
              }
            },
            "name": "ruby",
            "events": {
              "in": 45,
              "out": 45,
              "duration_in_millis": 86
            }
          }
        ],
        "outputs": [
          {
            "id": "c4f801c8f170b4cb0679f704413773acd5f291929f42302d0a56361400c3741b",
            "flow": {
              "worker_utilization": {
                "current": 0,
                "lifetime": 0.000668,
                "last_1_minute": 0.000269,
                "last_5_minutes": 0.000434,
                "last_15_minutes": 0.0006663
              },
              "worker_millis_per_event": {
                "lifetime": 4.8,
                "last_1_minute": 2,
                "last_5_minutes": 3.2,
                "last_15_minutes": 4.867
              }
            },
            "name": "stdout",
            "events": {
              "in": 45,
              "out": 45,
              "duration_in_millis": 216
            }
          }
        ]
      },
      "reloads": {
        "failures": 0,
        "successes": 0,
        "last_error": null,
        "last_failure_timestamp": null,
        "last_success_timestamp": null
      },
      "pipeline": {
        "workers": 12,
        "batch_size": 125,
        "batch_delay": 50
      },
      "ephemeral_id": "6a218b06-9655-4ddc-84e9-d5bfa51e5dc7"
    }
  }
}