logstash-docs-md
Codec plugins
A codec plugin changes the data representation of an event. Codecs are essentially stream filters that can operate as part of an input or output.
For a list of Elastic supported plugins, please consult the Support Matrix.
| Plugin | Description | Github repository |
| avro | Reads serialized Avro records as Logstash events | logstash-codec-avro |
| cef | Reads the ArcSight Common Event Format (CEF). | logstash-codec-cef |
| cloudfront | Reads AWS CloudFront reports | logstash-codec-cloudfront |
| cloudtrail | Reads AWS CloudTrail log files | logstash-codec-cloudtrail |
| collectd | Reads events from the collectd binary protocol using UDP. |
logstash-codec-collectd |
| csv | Takes CSV data, parses it, and passes it along. | logstash-codec-csv |
| dots | Sends 1 dot per event to stdout for performance tracking |
logstash-codec-dots |
| edn | Reads EDN format data | logstash-codec-edn |
| edn_lines | Reads newline-delimited EDN format data | logstash-codec-edn_lines |
| es_bulk | Reads the Elasticsearch bulk format into separate events, along with metadata | logstash-codec-es_bulk |
| fluent | Reads the fluentd msgpack schema |
logstash-codec-fluent |
| graphite | Reads graphite formatted lines |
logstash-codec-graphite |
| gzip_lines | Reads gzip encoded content |
logstash-codec-gzip_lines |
| jdots | Renders each processed event as a dot | core plugin |
| java_line | Encodes and decodes line-oriented text data | core plugin |
| java_plain | Processes text data with no delimiters between events | core plugin |
| json | Reads JSON formatted content, creating one event per element in a JSON array | logstash-codec-json |
| json_lines | Reads newline-delimited JSON | logstash-codec-json_lines |
| line | Reads line-oriented text data | logstash-codec-line |
| msgpack | Reads MessagePack encoded content | logstash-codec-msgpack |
| multiline | Merges multiline messages into a single event | logstash-codec-multiline |
| netflow | Reads Netflow v5 and Netflow v9 data | logstash-codec-netflow |
| nmap | Reads Nmap data in XML format | logstash-codec-nmap |
| plain | Reads plaintext with no delimiting between events | logstash-codec-plain |
| protobuf | Reads protobuf messages and converts to Logstash Events | logstash-codec-protobuf |
| rubydebug | Applies the Ruby Awesome Print library to Logstash events | logstash-codec-rubydebug |