Logstash 2.1 Release Notes


  • Issue 2376: Added ability to install and upgrade Logstash plugins without requiring internet connectivity.
  • Issue 3576: Support alternate or private Ruby gems server to install and update plugins.
  • Issue 3451: Added ability to reliably shutdown Logstash when there is a stall in event processing. This option can be enabled by passing --allow-unsafe-shutdown flag while starting Logstash. Please be aware that any in- flight events will be lost when shutdown happens.
  • Issue 4222: Fixed a memory leak which could be triggered when events having a date were serialized to string.
  • Added JDBC input to default package.
  • Issue 3243: Adding --debug to --configtest now shows the configuration in blocks annotated by source config file. Very useful when using multiple config files in a directory.
  • Issue 4130: Reset default worker threads to 1 when using non thread-safe filters like multiline.
  • Fixed file permissions for the logrotate configuration file.
  • Issue 3861: Changed the default heap size from 500MB to 1GB.
  • Issue 3645: Fixed config check option when starting Logstash through init scripts.

Input Plugins


  • Issue 21: Added an option to fetch data from the sample Twitter streaming endpoint.
  • Issue 22: Added hashtags, symbols and user_mentions as data for the non extended tweet event.
  • Issue 20: Added an option to filter per location and language.
  • Issue 11: Added an option to stream data from a list of users.


  • Issue 10: Properly handle multiline events from multiple sources, originating from Filebeat.


  • Issue 44: Properly handle multiline events from multiple sources.


  • Issue 11: Change the underlying library to capture Event Logs from Windows more reliably.



  • Improved the default template to use doc_values wherever possible.
  • Improved the default template to disable fielddata on analyzed string fields.
  • Issue 260: Added New setting: timeout. This lets you control the behavior of a slow/stuck request to Elasticsearch that could be, for example, caused by network, firewall, or load balancer issues.