Codec plugins

A codec plugin changes the data representation of an event. Codecs are essentially stream filters that can operate as part of an input or output.

The following codec plugins are available:

Plugin

Description

Github repository

avro

Reads serialized Avro records as Logstash events

logstash-codec-avro

cef

Reads the ArcSight Common Event Format (CEF).

logstash-codec-cef

cloudtrail

Reads AWS Cloudtrail events

logstash-codec-cloudtrail

cloudfront

Reads AWS CloudFront reports

logstash-codec-cloudfront

collectd

Reads events from the collectd binary protocol using UDP.

logstash-codec-collectd

compress_spooler

Compresses events into spooled batches

logstash-codec-compress_spooler

dots

Sends 1 dot per event to stdout for performance tracking

logstash-codec-dots

edn

Reads EDN format data

logstash-codec-edn

edn_lines

Reads newline-delimited EDN format data

logstash-codec-edn_lines

es_bulk

Reads the Elasticsearch bulk format into separate events, along with metadata

logstash-codec-es_bulk

fluent

Reads the fluentd msgpack schema

logstash-codec-fluent

graphite

Reads graphite formatted lines

logstash-codec-graphite

gzip_lines

Reads gzip encoded content

logstash-codec-gzip_lines

json

Reads JSON formatted content, creating one event per element in a JSON array

logstash-codec-json

json_lines

Reads newline-delimited JSON

logstash-codec-json_lines

line

Reads line-oriented text data

logstash-codec-line

msgpack

logstash-codec-msgpack

multiline

Merges multiline messages into a single event

logstash-codec-multiline

netflow

Reads Netflow v5 and Netflow v9 data

logstash-codec-netflow

nmap

Reads Nmap data in XML format

logstash-codec-nmap

oldlogstashjson

Reads Logstash JSON in the schema used by Logstash versions earlier than 1.2.0

logstash-codec-oldlogstashjson

plain

Reads plaintext with no delimiting between events

logstash-codec-plain

rubydebug

Applies the Ruby Awesome Print library to Logstash events

logstash-codec-rubydebug

s3_plain

Provides backwards compatibility with earlier versions of S3 Output

logstash-codec-s3_plain

spool

Collects events and transmits in batches

logstash-codec-spool