The Logstash Lines: Logstash deployment and scaling tips

Welcome back to The Logstash Lines! In these weekly posts, we'll share the latest happenings in the world of Logstash and its ecosystem.

This week, Justin Lintz from Chartbeat has some useful Logstash deployment and scaling tips for us:


Logstash Core and Plugins

  • Fixed a bunch of issues with the Windows Event Log input plugin and will continue to make it better.
  • Fixed an issue where the GeoIP filter plugin was not handling IPv6 inputs and would crash. While this filter does not support IPv6 lookups just yet, we have a community contribution for this enhancement currently in review.
  • Fixed an issue where the newline character was not being handled correctly in the config. This manifested as a mutate filter bug.
  • Started a proof of concept to rewrite the Event class in Java so we avoid the serialization cost between the Ruby and Java. This is a first step to see if we can have a Java implementation of the core pipeline. This would help the persistence work which involves serialization, and provide a Java interface to plugin developers while being compatible with existing plugins. Stay tuned for more information as we dig deeper!

That's this week in The Logstash Lines. Come back next week for more Logstash news!