Input plugins

An input plugin enables a specific source of events to be read by Logstash.

The following input plugins are available:

Elastic supported plugins

These plugins are maintained and supported by Elastic.

Plugin

Description

Github repository

beats

Receives events from the Elastic Beats framework

logstash-input-beats

couchdb_changes

Streams events from CouchDB’s _changes URI

logstash-input-couchdb_changes

elasticsearch

Reads query results from an Elasticsearch cluster

logstash-input-elasticsearch

file

Streams events from files

logstash-input-file

gelf

Reads GELF-format messages from Graylog2 as events

logstash-input-gelf

generator

Generates random log events for test purposes

logstash-input-generator

graphite

Reads metrics from the graphite tool

logstash-input-graphite

heartbeat

Generates heartbeat events for testing

logstash-input-heartbeat

http

Receives events over HTTP or HTTPS

logstash-input-http

http_poller

Decodes the output of an HTTP API into events

logstash-input-http_poller

jdbc

Creates events from JDBC data

logstash-input-jdbc

kafka

Reads events from a Kafka topic

logstash-input-kafka

log4j

Reads events over a TCP socket from a Log4j SocketAppender object

logstash-input-log4j

lumberjack

Receives events using the Lumberjack protocl

logstash-input-lumberjack

rabbitmq

Pulls events from a RabbitMQ exchange

logstash-input-rabbitmq

redis

Reads events from a Redis instance

logstash-input-redis

s3

Streams events from files in a S3 bucket

logstash-input-s3

sqs

Pulls events from an Amazon Web Services Simple Queue Service queue

logstash-input-sqs

stdin

Reads events from standard input

logstash-input-stdin

syslog

Reads syslog messages as events

logstash-input-syslog

tcp

Reads events from a TCP socket

logstash-input-tcp

twitter

Reads events from the Twitter Streaming API

logstash-input-twitter

udp

Reads events over UDP

logstash-input-udp

Community supported plugins

These plugins are maintained and supported by the community. These plugins have met the Logstash development & testing criteria for integration. Contributors include Community Maintainers, the Logstash core team at Elastic, and the broader community.

Plugin

Description

Github repository

cloudwatch

Pulls events from the Amazon Web Services CloudWatch API

logstash-input-cloudwatch

drupal_dblog

Retrieves watchdog log events from Drupal installations with DBLog enabled

logstash-input-drupal_dblog

eventlog

Pulls events from the Windows Event Log

logstash-input-eventlog

exec

Captures the output of a shell command as an event

logstash-input-exec

ganglia

Reads Ganglia packets over UDP

logstash-input-ganglia

gemfire

Pushes events to a GemFire region

logstash-input-gemfire

github

Reads events from a GitHub webhook

logstash-input-github

heroku

Streams events from the logs of a Heroku app

logstash-input-heroku

imap

Reads mail from an IMAP server

logstash-input-imap

irc

Reads events from an IRC server

logstash-input-irc

jmx

Retrieves metrics from remote Java applications over JMX

logstash-input-jmx

kinesis

Receives events through an AWS Kinesis stream

logstash-input-kinesis

meetup

Captures the output of command line tools as an event

logstash-input-meetup

pipe

Streams events from a long-running command pipe

logstash-input-pipe

puppet_facter

Receives facts from a Puppet server

logstash-input-puppet_facter

rackspace

Receives events from a Rackspace Cloud Queue service

logstash-input-rackspace

relp

Receives RELP events over a TCP socket

logstash-input-relp

rss

Captures the output of command line tools as an event

logstash-input-rss

salesforce

Creates events based on a Salesforce SOQL query

logstash-input-salesforce

snmptrap

Creates events based on SNMP trap messages

logstash-input-snmptrap

sqlite

Creates events based on rows in an SQLite database

logstash-input-sqlite

stomp

Creates events received with the STOMP protocol

logstash-input-stomp

unix

Reads events over a UNIX socket

logstash-input-unix

varnishlog

Reads from the varnish cache shared memory log

logstash-input-varnishlog

websocket

Reads events from a websocket

logstash-input-websocket

wmi

Creates events based on the results of a WMI query

logstash-input-wmi

xmpp

Receives events over the XMPP/Jabber protocol

logstash-input-xmpp

zenoss

Reads Zenoss events from the fanout exchange

logstash-input-zenoss

zeromq

Reads events from a ZeroMQ SUB socket

logstash-input-zeromq