A codec plugin changes the data representation of an event. Codecs are essentially stream filters that can operate as part of an input or output.
The following codec plugins are available:
Elastic supported pluginsedit
These plugins are maintained and supported by Elastic.
Reads serialized Avro records as Logstash events
Reads events from the
Sends 1 dot per event to
Reads the Elasticsearch bulk format into separate events, along with metadata
Reads JSON formatted content, creating one event per element in a JSON array
Reads newline-delimited JSON
Reads line-oriented text data
Merges multiline messages into a single event
Reads plaintext with no delimiting between events
Applies the Ruby Awesome Print library to Logstash events
Community supported pluginsedit
These plugins are maintained and supported by the community. These plugins have met the Logstash development & testing criteria for integration. Contributors include Community Maintainers, the Logstash core team at Elastic, and the broader community.
Reads the ArcSight Common Event Format (CEF).
Reads AWS CloudFront reports
Reads AWS Cloudtrail events
Compresses events into spooled batches
Reads EDN format data
Reads newline-delimited EDN format data
Reads Netflow v5 and Netflow v9 data
Reads Nmap data in XML format
Reads Logstash JSON in the schema used by Logstash versions earlier than 1.2.0
Provides backwards compatibility with earlier versions of S3 Output