Logstash documentation hub
Real-time server-side data processing pipeline. Collect from many sources, transform and enrich events, and ship to Elasticsearch or other outputs.
Get started with Logstash
Download Logstash, create a pipeline, and run it locally.
-
Download Logstash
Get the binary for your platform and unzip it. You need a JDK (Java 21) before you run.
-
Create your first pipeline
Write a config with an input, optional filters, and an output. A common first pipeline is stdin to Elasticsearch and stdout.
-
Run Logstash
Start Logstash with your config file from the command line.
-
Parse real logs
Follow a full example that collects logs, parses fields, and ships them to Elasticsearch.
What's new in Logstash
Highlights from the latest Logstash release.
-
OTLP metrics export
Export Logstash monitoring metrics to any OpenTelemetry-compatible endpoint. Technical preview.
Read more -
TLS certificate auto-reload
Pipelines reload when TLS certificates rotate on disk, without a full pipeline restart.
Read more -
cgroup v2 awareness
Read resource limits from cgroup v2 as well as v1, for modern Linux hosts and Kubernetes.
Read more -
Cloud API keys in Elasticsearch plugins
The Elasticsearch input, filter, and output plugins accept Elastic Cloud API keys in the api_key option.
Read more
Popular topics
Logstash has a rich collection of input, filter, codec, and output plugins. Use the Grok filter plugin to parse arbitrary text and structure it.
Explore Logstash
Explore the Logstash documentation, from installing and building pipelines to parsing, securing, troubleshooting, and more.
Quick links
-
Getting started
-
Configuration
-
Plugins