Monitoring Logstashedit

When you run Logstash, it automatically captures runtime metrics that you can use to monitor the health and performance of your Logstash deployment.

The metrics collected by Logstash include:

  • Logstash node info, like pipeline settings, OS info, and JVM info.
  • Plugin info, including a list of installed plugins.
  • Node stats, like JVM stats, process stats, event-related stats, and pipeline runtime stats.
  • Hot threads.

You can use the monitoring UI in X-Pack to view these metrics and gain insight into how your Logstash deployment is running.

Or you can use the basic monitoring APIs providing by Logstash to retrieve these metrics.

Monitoring UIedit


Monitoring is an X-Pack feature under the Basic License and is therefore free to use. To get started, consult the Logstash monitoring documentation.

When running Logstash 5.2 or greater, you can use the monitoring feature in X-Pack to gain deep visibility into metrics about your Logstash deployment. In the overview dashboard, you can see all events received and sent by Logstash, plus info about memory usage and uptime:

Logstash monitoring overview dashboard in Kibana

Then you can drill down to see stats about a specific node:

Logstash monitoring node stats dashboard in Kibana

See the Logstash monitoring documentation to learn how to set up and use this feature.

Monitoring APIsedit

Logstash provides the following monitoring APIs to retrieve runtime metrics about Logstash:

You can use the root resource to retrieve general information about the Logstash instance, including the host and version.

curl -XGET 'localhost:9600/?pretty'

Example response:

   "host": "skywalker",
   "version": "5.6.1",
   "http_address": ""

By default, the monitoring API attempts to bind to tcp:9600. If this port is already in use by another Logstash instance, you need to launch Logstash with the --http.port flag specified to bind to a different port. See Command-Line Flags for more information.

Common Optionsedit

The following options can be applied to all of the Logstash monitoring APIs.

Pretty Resultsedit

When appending ?pretty=true to any request made, the JSON returned will be pretty formatted (use it for debugging only!).

Human-Readable Outputedit


For Logstash 5.6.1, the human option is supported for the Hot Threads API only. When you specify human=true, the results are returned in plain text instead of JSON format. The default is false.

Statistics are returned in a format suitable for humans (eg "exists_time": "1h" or "size": "1kb") and for computers (eg "exists_time_in_millis": 3600000 or "size_in_bytes": 1024). The human-readable values can be turned off by adding ?human=false to the query string. This makes sense when the stats results are being consumed by a monitoring tool, rather than intended for human consumption. The default for the human flag is false.