Logstash 5.5.0 Release Notesedit

  • Introduced a new feature called dead letter queues. When enabled, the dead letter queue (DLQ) feature will route events to a file-based store when the output plugin is unable to process the events. Currently, the Elasticsearch output is the only plugin that uses this feature to store "dead" events that result from Elasticsearch mapping errors.
  • Upgraded to JRuby version 1.7.27.
  • Set the default entropy source to /dev/urandom. This change resolves an issue that caused Logstash to stall on startup for several minutes. This stall behavior was especially visible when Logstash was deployed on VMs (Issue 6117).
  • Added support to resolve environment variables specified in the logstash.yml file (Issue 6785).
  • Fixed the ability to change log levels via the API (Issue 7277).

Filter Pluginsedit


  • A warning message is no longer logged when ISO8601 format and timezone interpolation is used (#97).


  • Added a new copy option that allows users to clone a field into a new field target.