Logstash documentation hub
Real-time server-side data processing pipeline. Collect from many sources, transform and enrich events, and ship to Elasticsearch or other outputs.
Get started with Logstash
-
Download Logstash
Get the binary for your platform. You need a JDK (Java 21) to run it.
-
Create your first pipeline
Write a config with an input, optional filters, and an output.
-
Run Logstash
Start Logstash with your config file.
-
Parse real logs
Follow a full example, from raw logs to Elasticsearch.
What's new in Logstash
Highlights from recent releases.
-
OTLP metrics export
Export Logstash monitoring metrics to any OpenTelemetry-compatible endpoint. Technical preview.
Read more -
Kafka integration plugin 12
The plugin now uses Kafka client 4.x, supports an opt-in consumer group protocol, and drops two partitioner options. Review the breaking changes before you upgrade.
Read more -
TLS certificate auto-reload
Pipelines reload when TLS certificates rotate on disk, without a full pipeline restart.
Read more -
cgroup v2 awareness
Read resource limits from cgroup v2 as well as v1, for modern Linux hosts and Kubernetes.
Read more -
Cloud API keys in Elasticsearch plugins
The Elasticsearch input, filter, and output plugins accept Elastic Cloud API keys in the api_key option.
Read more
Popular topics in Logstash
Logstash has a rich collection of input, filter, codec, and output plugins. Use the Grok filter plugin to parse arbitrary text and structure it.
-
Plugins
-
Grok parsing
Explore Logstash
Explore the Logstash documentation, from installing and building pipelines to parsing, securing, troubleshooting, and more.
Quick links
-
Getting started
-
Configuration
-
Plugins