Elastic Docs ›Logstash Versioned Plugin Reference ›Output plugins ›Versioned logstash output plugin docs
« Logstash output plugin v0.0.2 Versioned lumberjack output plugin docs »

Logstash output plugin v0.0.1edit

For other versions, see the overview list.

To learn more about Logstash, see the Logstash Reference.

Getting Helpedit

For questions about the plugin, open a topic in the Discuss forums. For bugs or feature requests, open an issue in Github. For the list of Elastic supported plugins, please consult the Elastic Support Matrix.

Descriptionedit

Send events to a logstash input plugin in a pipeline that may be in another process or on another host. You must have a TCP route to the port on an interface that the downstream input is bound to.

Sending events to any destination other than logstash input plugin is neither advised nor supported. We will maintain cross-compatibility with any two supported versions of output/input pair and reserve the right to change details such as protocol and encoding.

Minimum Configurationedit

SSL Enabled SSL Disabled 
output {
  logstash {
    host => "10.0.0.123"
    port => 8080
  }
}
 
output {
  logstash {
    host => "10.0.0.123"
    port => 8080
    ssl_enabled
         => false
  }
}

Configuration Conceptsedit

This output plugin needs to be configured to connect to a logstash input plugin by specifying its host and port. Depending on the downstream plugin’s configuration, you may need to also configure SSL and/or credentials.

Security: SSL Trustedit

When communicating over SSL, this plugin establishes trust of the server it connects to before transmitting credentials or events.

It does so by ensuring that the server presents a currently-valid certificate with identity claims matching the host we are configured to connect to, signed by a trusted signing authority, along with proof-of-possession of the associated private key material.

The system trust store is used by default. You can provide an alternate source of trust with ONE OF:

Security: SSL Identityedit

If the downstream input plugin is configured to request or require client authentication, you can configure this plugin to provide its proof-of-identity with ONE OF:

Security: Credentialsedit

If the downstream logstash input plugin is configured to require username and password, you will need to configure this output with a matching username and password.

when SSL is disabled, data and credentials will be transmitted in clear-text.

Logstash Output Configuration Optionsedit

This plugin supports the following configuration options plus the Common Options described later.

Setting Input type Required

host

string

Yes

password

password

No

port

number

Yes

ssl_enabled

boolean

No

ssl_certificate

path

No

ssl_certificate_authorities

list of path

No

ssl_key

path

No

ssl_keystore_path

path

No

ssl_keystore_password

password

No

ssl_truststore_path

path

No

ssl_truststore_password

password

No

ssl_verification_mode

string, one of ["full", "none"]

No

username

string

No

Also see Common Options for a list of options supported by all output plugins.

 

hostedit

  • Value type is a string ip address or hostname
  • There is no default value

Specify which host to connect to by providing its ip address or resolvable hostname.

when using SSL, the server that responds must present a certificated with identity claim matching this host name or ip address.

portedit

  • Value type is a number port
  • There is no default value

Specify which port to connect to.

passwordedit

  • Value type is password
  • There is no default value for this setting.
  • Required when username is configured.

Password for password-based authentication.

When the downstream input plugin is configured with a username and password, you must also configure upstream outputs with a matching username/password pair.

ssl_enablededit

  • Value type is boolean
  • Default value is true

Logstash-to-Logstash communication is secured by default. When the downstream input plugin disables SSL, it must also be disabled here.

You can disable SSL with +ssl_enabled => false+. When disabled, setting any ssl_* configuration causes configuration failure.

ssl_certificateedit

  • Value type is path
  • There is no default value for this setting.
  • When present, ssl_key is also required.
  • Cannot be combined with configurations that disable SSL.

Path to a PEM-encoded certificate or certificate chain with which to identify this plugin to connecting downstream input.

ssl_certificate_authoritiesedit

  • Value type is a path
  • There is no default value for this setting.
  • Cannot be combined with configurations that disable SSL.
  • Cannot be combined with +ssl_verification_mode => none+.

One or more PEM-encoded files defining certificate authorities for use in downstream input authentication. This setting can be used to override the system trust store for verifying the SSL certificate presented by downstream input.

ssl_keyedit

  • Value type is path
  • There is no default value for this setting.
  • Required when connection identity is configured with ssl_certificate
  • Cannot be combined with configurations that disable SSL.

A path to an PEM-encoded unencrypted PKCS8 SSL certificate key.

ssl_keystore_pathedit

  • Value type is path
  • There is no default value for this setting.
  • When present, ssl_keystore_password is also required.
  • Cannot be combined with configurations that disable SSL.

A path to a JKS- or PKCS12-formatted keystore with which to identify this plugin to the downstream input. The provided identity will be used if the downstream input enables SSL client authentication.

ssl_keystore_passwordedit

  • Value type is password
  • There is no default value for this setting.
  • Required when connection identity is configured with ssl_keystore_path
  • Cannot be combined with configurations that disable SSL.

Password for the ssl_keystore_path

ssl_truststore_pathedit

A path to a JKS- or PKCS12-formatted truststore with which to validate the identity claims of the downstream input. The provided identity will be used if the downstream input enables SSL client authentication.

ssl_truststore_passwordedit

  • Value type is password
  • There is no default value for this setting.
  • Required when connection identity is configured with ssl_truststore_path
  • Cannot be combined with configurations that disable SSL.

Password for the ssl_truststore_path

ssl_verification_modeedit

  • Value type is string

  • The supported modes are:

    • full: verifies that a certificate provided by the client has an identity claim matching host, is signed by a trusted authority (CA), is within its valid date range, and that the client has possession of the associated key.
    • none: performs no validation of the presented certificate
  • The default value is full.
  • Cannot be combined with configurations that disable SSL.

When communicating over SSL, this setting controls how the downstream input’s certificate is verified.

usernameedit

  • Value type is string
  • There is no default value for this setting.
  • When present, password is also required.

Username for password-based authentication.

When the downstream input plugin is configured with a username and password, you must also configure upstream outputs with a matching username/password pair.

when SSL is disabled, credentials will be transmitted in clear-text.

Common Optionsedit

The following configuration options are supported by all output plugins:

Setting Input type Required

enable_metric

boolean

No

id

string

No

enable_metricedit

  • Value type is boolean
  • Default value is true

Disable or enable metric logging for this specific plugin instance. By default we record all the metrics we can, but you can disable metrics collection for a specific plugin.

idedit

  • Value type is string
  • There is no default value for this setting.

Add a unique ID to the plugin configuration. If no ID is specified, Logstash will generate one. It is strongly recommended to set this ID in your configuration. This is particularly useful when you have two or more plugins of the same type. For example, if you have 2 logstash outputs. Adding a named ID in this case will help in monitoring Logstash when using the monitoring APIs.

output {
  logstash {
    id => "my_plugin_id"
  }
}
« Logstash output plugin v0.0.2 Versioned lumberjack output plugin docs »