Logstash 5.6.0 Release Notesedit

  • Introduced modules for Netflow and ArcSight data. Modules contain pre-packaged Logstash configuration, Kibana dashboards and other metadata files to ease the set up of the Elastic stack for certain data sources. The goal of these modules are to provide an end-to-end, 5-min getting started experience for a user exploring a data source.
  • Added a new setting called config.support_escapes. This setting enables the use of escape characters such as \n in the Logstash configuration.
  • Improved the performance of metrics collection and reporting infrastructure. Overall, in this release, there is lower load average, less GC and higher throughput when running Logstash.
  • When processing events from the DLQ, there are added checks now to stop them from being written to the DLQ again.
  • Fixed an issue which would crash Logstash when accessing DLQ events using a timestamp range.

Filter Pluginsedit

GeoIP: The free GeoIPLite2-ASN database from MaxMind is now bundled in Logstash to be able to look up ASN data out of the box.