--- title: Logstash documentation hub description: Logstash documentation. Collect events from any source, transform and enrich them, and ship to Elasticsearch or other destinations. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7964/products/logstash products: - Logstash --- # Logstash documentation hub Real-time server-side data processing pipeline. Collect from many sources, transform and enrich events, and ship to Elasticsearch or other outputs. - [Get started](#get-started) - [What's new](#whats-new) - [Explore Logstash docs](#explore) ## Get started with Logstash Download Logstash, create a pipeline, and run it locally. 1. [Download Logstash](https://www.elastic.co/downloads/logstash) Get the binary for your platform and unzip it. You need a JDK (Java 21) before you run. 2. [Create your first pipeline](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/creating-logstash-pipeline) Write a config with an input, optional filters, and an output. A common first pipeline is stdin to Elasticsearch and stdout. 3. [Run Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/running-logstash-command-line) Start Logstash with your config file from the command line. 4. [Parse real logs](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/advanced-pipeline) Follow a full example that collects logs, parses fields, and ships them to Elasticsearch. ## What's new in Logstash Highlights from the latest Logstash release. - [Release notes](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/release-notes) - [OTLP metrics export](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/monitoring-with-opentelemetry) (9.5, Monitoring) Export Logstash monitoring metrics to any OpenTelemetry-compatible endpoint. Technical preview. - [TLS certificate auto-reload](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/reloading-config) (9.5, Security) Pipelines reload when TLS certificates rotate on disk, without a full pipeline restart. - [cgroup v2 awareness](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/release-notes) (9.5, Containers) Read resource limits from cgroup v2 as well as v1, for modern Linux hosts and Kubernetes. - [Cloud API keys in Elasticsearch plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-outputs-elasticsearch) (9.5, Elasticsearch) The Elasticsearch input, filter, and output plugins accept Elastic Cloud API keys in the api_key option. - [Upgrade Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/upgrading-logstash) ### Popular topics Logstash has a rich collection of input, filter, codec, and output plugins. Use the Grok filter plugin to parse arbitrary text and structure it. #### [Plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/input-plugins) - [Input plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/input-plugins) - [Filter plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/filter-plugins) - [Output plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/output-plugins) #### [Grok parsing](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-grok) - [Grok filter plugin](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-grok) - [Grok Debugger](https://docs-v3-preview.elastic.dev/explore-analyze/query-filter/tools/grok-debugger) - [Grok pattern reference](https://docs-v3-preview.elastic.dev/explore-analyze/scripting/grok) ## Explore Logstash Explore the Logstash documentation, from installing and building pipelines to parsing, securing, troubleshooting, and more. ### Quick links #### Getting started - [Getting started with Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/getting-started-with-logstash) - [How Logstash works](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/how-logstash-works) - [Installing Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/installing-logstash) #### Configuration - [Configuration files](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/config-setting-files) - [logstash.yml](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-settings-file) - [Config examples](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/config-examples) #### Plugins - [Working with plugins](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/working-with-plugins) - [Input plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/input-plugins) - [Output plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/output-plugins) ### Install, operate, and configure #### [Install](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/installing-logstash) Install and run Logstash on your own infrastructure. - [Installing Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/installing-logstash) - [Docker](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/docker) - [Docker configuration](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/docker-config) - [Windows](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/running-logstash-windows) - [Setting up and running](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/setting-up-running-logstash) #### [Operate](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/upgrading-logstash) Upgrade, scale, tune, and monitor Logstash. - [Upgrade Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/upgrading-logstash) - [Deploy and scale](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/deploying-scaling-logstash) - [Tuning](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/tuning-logstash) - [Monitoring](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/monitoring-logstash) - [Monitoring UI](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-monitoring-ui) #### [Configure](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/config-setting-files) Settings files, YAML config, and config reload. - [Configuration files](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/config-setting-files) - [logstash.yml](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-settings-file) - [Reload configuration](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/reloading-config) ### Ingest #### [Build pipelines](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/creating-logstash-pipeline) Create and structure Logstash pipelines. - [Creating a pipeline](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/creating-logstash-pipeline) - [How Logstash works](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/how-logstash-works) - [Multiple pipelines](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/multiple-pipelines) - [Parsing logs tutorial](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/advanced-pipeline) #### [Inputs](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/input-plugins) Collect events from files, beats, agents, JDBC, and more. - [Input plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/input-plugins) - [JDBC input](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-inputs-jdbc) - [Beats input](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-inputs-beats) - [Filebeat → Logstash](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/logstash-output) - [Elastic Agent → Logstash](https://docs-v3-preview.elastic.dev/reference/fleet/logstash-output) #### [Outputs](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/output-plugins) Send processed events to Elasticsearch and other destinations. - [Output plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/output-plugins) - [Elasticsearch output](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-outputs-elasticsearch) - [Logstash-to-Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-to-logstash-communications) - [Logstash → Elasticsearch architecture](https://docs-v3-preview.elastic.dev/manage-data/ingest/ingest-reference-architectures/ls-for-input) #### [Central management and integrations](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-centralized-pipeline-management) Manage pipelines from Kibana and extend Elastic Integrations. - [Centralized pipeline management](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-centralized-pipeline-management) - [Logstash pipelines in Kibana](https://docs-v3-preview.elastic.dev/manage-data/ingest/transform-enrich/logstash-pipelines) - [Elastic Integrations](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/using-logstash-with-elastic-integrations) ### Parse and transform #### [Parse unstructured logs](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-grok) Extract fields from log lines with grok, dissect, and pipeline tutorials. - [Grok filter](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-grok) - [Dissect filter](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-dissect) - [Parsing logs with Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/advanced-pipeline) - [Field extraction](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/field-extraction) #### [Debug patterns](https://docs-v3-preview.elastic.dev/explore-analyze/query-filter/tools/grok-debugger) Build and test grok patterns before you deploy them. - [Grok Debugger](https://docs-v3-preview.elastic.dev/explore-analyze/query-filter/tools/grok-debugger) - [Grok pattern reference](https://docs-v3-preview.elastic.dev/explore-analyze/scripting/grok) #### [Filter and enrich](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/filter-plugins) Transform events with filters and Elastic Integrations processing. - [Filter plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/filter-plugins) - [Mutate filter](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-mutate) - [Elastic Integration filter](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-elastic_integration) - [Transforming data](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/transforming-data) #### [Inspect pipelines](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-pipeline-viewer) View pipeline topology and processing in Kibana. - [Pipeline viewer](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-pipeline-viewer) ### Secure #### [Connect to Elasticsearch](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/secure-connection) TLS, authentication, and API keys for Elasticsearch and Serverless. - [Secure your connection](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/secure-connection) - [Connecting to Elastic Cloud](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/connecting-to-cloud) #### [TLS on the wire](https://docs-v3-preview.elastic.dev/reference/fleet/secure-logstash-connections) Secure connections between agents, Beats, and Logstash. - [Secure Logstash connections (Fleet)](https://docs-v3-preview.elastic.dev/reference/fleet/secure-logstash-connections) - [Filebeat SSL to Logstash](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/filebeat/configuring-ssl-logstash) #### [Secrets](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/keystore) Store credentials and sensitive settings in the Logstash keystore. - [Logstash keystore](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/keystore) ### Troubleshoot #### [Diagnose common issues](https://docs-v3-preview.elastic.dev/troubleshoot/ingest/logstash) Startup, pipeline, and ingestion troubleshooting. - [Troubleshoot Logstash](https://docs-v3-preview.elastic.dev/troubleshoot/ingest/logstash) - [Performance troubleshooting](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/performance-troubleshooting) - [Monitoring troubleshooting](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/monitoring-troubleshooting) #### [Capture diagnostics](https://docs-v3-preview.elastic.dev/troubleshoot/ingest/logstash/diagnostic) Collect diagnostics for support and debugging. - [Capture Logstash diagnostics](https://docs-v3-preview.elastic.dev/troubleshoot/ingest/logstash/diagnostic) #### [Logging](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logging) Configure and read Logstash logs. - [Logging](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logging) ### Reference #### [Plugins](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/working-with-plugins) Install, list, and configure Logstash plugins. - [Working with plugins](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/working-with-plugins) - [Input plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/input-plugins) - [Filter plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/filter-plugins) - [Codec plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/codec-plugins) - [Output plugins](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/output-plugins) #### [Settings and config](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-settings-file) Settings reference and configuration examples. - [logstash.yml](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/logstash-settings-file) - [Configuration file structure](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/configuration-file-structure) - [Config examples](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/config-examples) #### [Releases](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/release-notes) What's new, breaking changes, and upgrades. - [Release notes](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/release-notes) - [Breaking changes](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/release-notes/breaking-changes) - [Upgrade Logstash](https://docs-v3-preview.elastic.dev/elastic/logstash/tree/main/reference/upgrading-logstash)