Logstash 5.2.0 Release Notesedit

  • Added the ability to collect and report on cgroup information. This info is helpful when you’re running Logstash in a container and the normal metrics like CPU and system load are still tracked at the machine level, not the container level (Issue 6252).
  • Persistent queue stats are now available in stats API when persistent queues are enabled. Metrics such as the number of events in the queue waiting to be processed and disk space info are reported (Issue 6508).
  • Plugin outputs have been enhanced to report wall-clock execution time. This info is available in the duration_in_millis field in the node stats API response (Issue 6458).
  • Offline plugin management: Introduced a new mechanism to manage plugins in an offline (air-gapped) environment. The previous approach would not completely download the plugins' dependency chain on the staging machine. A new command called prepare-offline-pack replaces the existing pack and unpack subcommands in the logstash-plugin CLI to manage offline plugins. The pack and unpack subcommands are now deprecated (Issue 6393).
  • Fixed an issue where plugins couldn’t be installed when HTTP proxy was enabled in Logstash deployments (Issue 6044, Issue 5777, Issue 5966).
  • Improved user facing error when logstash.yml is invalid (Issue 6509).
  • Fixed an issue where the Logstash slowlog took_in_millis field reported values in microseconds instead of milliseconds (Issue 6476).
  • Added explicit fsync when writing to the checkpoint file to ensure date has been flushed to disk.
  • The jvm.options file is now loaded relative to the location of logstash.yml or, if path.settings is specified, relative to the specified path (Issue 6379).
  • Added ability to create a startup init script to the system-install utility (Issue 6148).

Input Pluginsedit


  • Made error reporting clearer when the connection to a Kafka broker fails.
  • Made a change to set the kerberos option only when using GSSAPI.


  • Added ability to store the name and value of ganglia metrics (Issue 2).


  • Fixed issue where metadata would be broken for string values larger than 255 chars in message headers (Issue 94)

Filter Pluginsedit


  • Fixed a bug that caused the target field to be overwritten by looked up GeoIP data. The target field is now merged instead of being completely overwritten (Issue 98).


  • Fixed a bug that caused the plugin to crash when the every config option was set (Issue 5).

Codec Pluginsedit


  • Added support for VMware VDS IPFIX.
  • Fixed 0-length scope field length (Netflow 9, Juniper SRX)

Output Pluginsedit


  • Previously users could specify a proxy configuration as a hash. This has been disabled due to security reasons.
  • The proxy feature has been fixed to work when authentication credentials are specified in the URL (Issue 516).
  • Fixed a bug that forced users to URL encode the password option. Passwords with special characters can be used directly in the URL or in the password option.


  • Updated this plugin to use the v2.0 of the AWS SDK which brings in many updates and bug fixes.
  • Improved efficiency of uploading large files to S3 by using S3’s upload_file method. This method handles large files in multi-part chunks.
  • Added new option called server_side_encryption that allows users to specify the type of encryption (Issue 62)
  • Added support for dynamically configuring file paths within an S3 bucket. Field references can now be used to specify a prefix for the target in S3 (Issue 4)
  • Added new config option storage_class to specify what S3 storage class to use when uploading the file.