Graphite output pluginedit

  • Plugin version: v3.1.6
  • Released on: 2018-07-11
  • Changelog

For other versions, see the Versioned plugin docs.

Getting Helpedit

For questions about the plugin, open a topic in the Discuss forums. For bugs or feature requests, open an issue in Github. For the list of Elastic supported plugins, please consult the Elastic Support Matrix.


This output allows you to pull metrics from your logs and ship them to Graphite. Graphite is an open source tool for storing and graphing metrics.

An example use case: Some applications emit aggregated stats in the logs every 10 seconds. Using the grok filter and this output, it is possible to capture the metric values from the logs and emit them to Graphite.

Graphite Output Configuration Optionsedit

This plugin supports the following configuration options plus the Common Options described later.

Also see Common Options for a list of options supported by all output plugins.



  • Value type is array
  • Default value is ["%{[^}]+}"]

Exclude regex matched metric names, by default exclude unresolved %{field} strings.


  • Value type is boolean
  • Default value is false

An array indicating that these event fields should be treated as metrics and will be sent verbatim to Graphite. You may use either fields_are_metrics or metrics, but not both.


  • Value type is string
  • Default value is "localhost"

The hostname or IP address of the Graphite server.


  • Value type is array
  • Default value is [".*"]

Include only regex matched metric names.


  • Value type is hash
  • Default value is {}

The metric(s) to use. This supports dynamic strings like %{host} for metric names and also for values. This is a hash field with key being the metric name, value being the metric value. Example:

    metrics => { "%{host}/uptime" => "%{uptime_1m}" }

The value will be coerced to a floating point value. Values which cannot be coerced will be set to zero (0). You may use either metrics or fields_are_metrics, but not both.


  • Value type is string
  • Default value is "*"

Defines the format of the metric string. The placeholder * will be replaced with the name of the actual metric.

    metrics_format => "*.sum"

If no metrics_format is defined, the name of the metric will be used as fallback.


  • Value type is string
  • Default value is "."

When hashes are passed in as values they are broken out into a dotted notation For instance if you configure this plugin with # [source,ruby] metrics ⇒ "mymetrics"

and "mymetrics" is a nested hash of {a ⇒ 1, b ⇒ { c ⇒ 2 }} this plugin will generate two metrics: a ⇒ 1, and b.c ⇒ 2 . If you’ve specified a metrics_format it will respect that, but you still may want control over the separator within these nested key names. This config setting changes the separator from the . default.


  • Value type is number
  • Default value is 2003

The port to connect to on the Graphite server.


  • Value type is number
  • Default value is 2

Interval between reconnect attempts to Carbon.


  • Value type is boolean
  • Default value is false

Should metrics be resent on failure?


  • Value type is string
  • Default value is "@timestamp"

Use this field for the timestamp instead of @timestamp which is the default. Useful when backfilling or just getting more accurate data into graphite since you probably have a cache layer infront of Logstash.

Common Optionsedit

The following configuration options are supported by all output plugins:

Setting Input type Required











  • Value type is codec
  • Default value is "plain"

The codec used for output data. Output codecs are a convenient method for encoding your data before it leaves the output without needing a separate filter in your Logstash pipeline.


  • Value type is boolean
  • Default value is true

Disable or enable metric logging for this specific plugin instance. By default we record all the metrics we can, but you can disable metrics collection for a specific plugin.


  • Value type is string
  • There is no default value for this setting.

Add a unique ID to the plugin configuration. If no ID is specified, Logstash will generate one. It is strongly recommended to set this ID in your configuration. This is particularly useful when you have two or more plugins of the same type. For example, if you have 2 graphite outputs. Adding a named ID in this case will help in monitoring Logstash when using the monitoring APIs.

output {
  graphite {
    id => "my_plugin_id"

Variable substitution in the id field only supports environment variables and does not support the use of values from the secret store.