Codec pluginsedit

A codec plugin changes the data representation of an event. Codecs are essentially stream filters that can operate as part of an input or output.

The following codec plugins are available:

Elastic supported plugins

These plugins are maintained and supported by Elastic.

Plugin

Description

Github repository

avro

Reads serialized Avro records as Logstash events

logstash-codec-avro

collectd

Reads events from the collectd binary protocol using UDP.

logstash-codec-collectd

dots

Sends 1 dot per event to stdout for performance tracking

logstash-codec-dots

es_bulk

Reads the Elasticsearch bulk format into separate events, along with metadata

logstash-codec-es_bulk

fluent

Reads the fluentd msgpack schema

logstash-codec-fluent

graphite

Reads graphite formatted lines

logstash-codec-graphite

json

Reads JSON formatted content, creating one event per element in a JSON array

logstash-codec-json

json_lines

Reads newline-delimited JSON

logstash-codec-json_lines

line

Reads line-oriented text data

logstash-codec-line

msgpack

 

logstash-codec-msgpack

multiline

Merges multiline messages into a single event

logstash-codec-multiline

plain

Reads plaintext with no delimiting between events

logstash-codec-plain

rubydebug

Applies the Ruby Awesome Print library to Logstash events

logstash-codec-rubydebug

Community supported plugins

These plugins are maintained and supported by the community. These plugins have met the Logstash development & testing criteria for integration. Contributors include Community Maintainers, the Logstash core team at Elastic, and the broader community.

Plugin

Description

Github repository

cef

Reads the ArcSight Common Event Format (CEF).

logstash-codec-cef

cloudfront

Reads AWS CloudFront reports

logstash-codec-cloudfront

cloudtrail

Reads AWS Cloudtrail events

logstash-codec-cloudtrail

compress_spooler

Compresses events into spooled batches

logstash-codec-compress_spooler

edn

Reads EDN format data

logstash-codec-edn

edn_lines

Reads newline-delimited EDN format data

logstash-codec-edn_lines

gzip_lines

Reads gzip encoded content

logstash-codec-gzip_lines

netflow

Reads Netflow v5 and Netflow v9 data

logstash-codec-netflow

nmap

Reads Nmap data in XML format

logstash-codec-nmap

oldlogstashjson

Reads Logstash JSON in the schema used by Logstash versions earlier than 1.2.0

logstash-codec-oldlogstashjson

s3_plain

Provides backwards compatibility with earlier versions of S3 Output

logstash-codec-s3_plain