﻿---
title: Filter plugins
description: A filter plugin performs intermediary processing on an event. Filters are often applied conditionally depending on the characteristics of the event. The...
url: https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/filter-plugins
---

# Filter plugins
A filter plugin performs intermediary processing on an event. Filters are often applied conditionally depending on the
characteristics of the event.
The following filter plugins are available below. For a list of Elastic supported plugins, please consult the [Support Matrix](https://www.elastic.co/support/matrix#show_logstash_plugins).

| Plugin                                                                                                                                                            | Description                                                                                                                | Github repository                                                                                                                               |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|
| [age](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-age)age                                                          | Calculates the age of an event by subtracting the event timestamp from the current timestamp                               | [logstash-filter-age](https://github.com/logstash-plugins/logstash-filter-age)logstash-filter-age                                               |
| [aggregate](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-aggregate)aggregate                                        | Aggregates information from several events originating with a single task                                                  | [logstash-filter-aggregate](https://github.com/logstash-plugins/logstash-filter-aggregate)logstash-filter-aggregate                             |
| [alter](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-alter)alter                                                    | Performs general alterations to fields that the `mutate` filter does not handle                                            | [logstash-filter-alter](https://github.com/logstash-plugins/logstash-filter-alter)logstash-filter-alter                                         |
| [bytes](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-bytes)bytes                                                    | Parses string representations of computer storage sizes, such as "123 MB" or "5.6gb", into their numeric value in bytes    | [logstash-filter-bytes](https://github.com/logstash-plugins/logstash-filter-bytes)logstash-filter-bytes                                         |
| [cidr](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-cidr)cidr                                                       | Checks IP addresses against a list of network blocks                                                                       | [logstash-filter-cidr](https://github.com/logstash-plugins/logstash-filter-cidr)logstash-filter-cidr                                            |
| [cipher](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-cipher)cipher                                                 | Applies or removes a cipher to an event                                                                                    | [logstash-filter-cipher](https://github.com/logstash-plugins/logstash-filter-cipher)logstash-filter-cipher                                      |
| [clone](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-clone)clone                                                    | Duplicates events                                                                                                          | [logstash-filter-clone](https://github.com/logstash-plugins/logstash-filter-clone)logstash-filter-clone                                         |
| [csv](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-csv)csv                                                          | Parses comma-separated value data into individual fields                                                                   | [logstash-filter-csv](https://github.com/logstash-plugins/logstash-filter-csv)logstash-filter-csv                                               |
| [date](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-date)date                                                       | Parses dates from fields to use as the Logstash timestamp for an event                                                     | [logstash-filter-date](https://github.com/logstash-plugins/logstash-filter-date)logstash-filter-date                                            |
| [de_dot](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-de_dot)de_dot                                                 | Computationally expensive filter that removes dots from a field name                                                       | [logstash-filter-de_dot](https://github.com/logstash-plugins/logstash-filter-de_dot)logstash-filter-de_dot                                      |
| [dissect](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-dissect)dissect                                              | Extracts unstructured event data into fields using delimiters                                                              | [logstash-filter-dissect](https://github.com/logstash-plugins/logstash-filter-dissect)logstash-filter-dissect                                   |
| [dns](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-dns)dns                                                          | Performs a standard or reverse DNS lookup                                                                                  | [logstash-filter-dns](https://github.com/logstash-plugins/logstash-filter-dns)logstash-filter-dns                                               |
| [drop](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-drop)drop                                                       | Drops all events                                                                                                           | [logstash-filter-drop](https://github.com/logstash-plugins/logstash-filter-drop)logstash-filter-drop                                            |
| [elapsed](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-elapsed)elapsed                                              | Calculates the elapsed time between a pair of events                                                                       | [logstash-filter-elapsed](https://github.com/logstash-plugins/logstash-filter-elapsed)logstash-filter-elapsed                                   |
| [elastic_integration](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-elastic_integration)elastic_integration          | Provides additional Logstash processing on data from Elastic integrations                                                  | [logstash-filter-elastic_integration](https://github.com/elastic/logstash-filter-elastic_integration)logstash-filter-elastic_integration        |
| [elasticsearch](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-elasticsearch)elasticsearch                            | Copies fields from previous log events in Elasticsearch to current events                                                  | [logstash-filter-elasticsearch](https://github.com/logstash-plugins/logstash-filter-elasticsearch)logstash-filter-elasticsearch                 |
| [environment](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-environment)environment                                  | Stores environment variables as metadata sub-fields                                                                        | [logstash-filter-environment](https://github.com/logstash-plugins/logstash-filter-environment)logstash-filter-environment                       |
| [extractnumbers](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-extractnumbers)extractnumbers                         | Extracts numbers from a string                                                                                             | [logstash-filter-extractnumbers](https://github.com/logstash-plugins/logstash-filter-extractnumbers)logstash-filter-extractnumbers              |
| [fingerprint](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-fingerprint)fingerprint                                  | Fingerprints fields by replacing values with a consistent hash                                                             | [logstash-filter-fingerprint](https://github.com/logstash-plugins/logstash-filter-fingerprint)logstash-filter-fingerprint                       |
| [geoip](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-geoip)geoip                                                    | Adds geographical information about an IP address                                                                          | [logstash-filter-geoip](https://github.com/logstash-plugins/logstash-filter-geoip)logstash-filter-geoip                                         |
| [grok](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-grok)grok                                                       | Parses unstructured event data into fields                                                                                 | [logstash-filter-grok](https://github.com/logstash-plugins/logstash-filter-grok)logstash-filter-grok                                            |
| [http](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-http)http                                                       | Provides integration with external web services/REST APIs                                                                  | [logstash-filter-http](https://github.com/logstash-plugins/logstash-filter-http)logstash-filter-http                                            |
| [i18n](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-i18n)i18n                                                       | Removes special characters from a field                                                                                    | [logstash-filter-i18n](https://github.com/logstash-plugins/logstash-filter-i18n)logstash-filter-i18n                                            |
| [java_uuid](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-java_uuid)java_uuid                                        | Generates a UUID and adds it to each processed event                                                                       | [core plugin](https://github.com/elastic/logstash/blob/master/logstash-core/src/main/java/org/logstash/plugins/filters/Uuid.java)core plugin    |
| [jdbc_streaming](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-jdbc_streaming)jdbc_streaming                         | Enrich events with your database data                                                                                      | [logstash-integration-jdbc](https://github.com/logstash-plugins/logstash-integration-jdbc)logstash-integration-jdbc                             |
| [json](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-json)json                                                       | Parses JSON events                                                                                                         | [logstash-filter-json](https://github.com/logstash-plugins/logstash-filter-json)logstash-filter-json                                            |
| [json_encode](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-json_encode)json_encode                                  | Serializes a field to JSON                                                                                                 | [logstash-filter-json_encode](https://github.com/logstash-plugins/logstash-filter-json_encode)logstash-filter-json_encode                       |
| [kv](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-kv)kv                                                             | Parses key-value pairs                                                                                                     | [logstash-filter-kv](https://github.com/logstash-plugins/logstash-filter-kv)logstash-filter-kv                                                  |
| [memcached](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-memcached)memcached                                        | Provides integration with external data in Memcached                                                                       | [logstash-filter-memcached](https://github.com/logstash-plugins/logstash-filter-memcached)logstash-filter-memcached                             |
| [metricize](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-metricize)metricize                                        | Takes complex events containing a number of metrics and splits these up into multiple events, each holding a single metric | [logstash-filter-metricize](https://github.com/logstash-plugins/logstash-filter-metricize)logstash-filter-metricize                             |
| [metrics](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-metrics)metrics                                              | Aggregates metrics                                                                                                         | [logstash-filter-metrics](https://github.com/logstash-plugins/logstash-filter-metrics)logstash-filter-metrics                                   |
| [mutate](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-mutate)mutate                                                 | Performs mutations on fields                                                                                               | [logstash-filter-mutate](https://github.com/logstash-plugins/logstash-filter-mutate)logstash-filter-mutate                                      |
| [prune](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-prune)prune                                                    | Prunes event data based on a list of fields to blacklist or whitelist                                                      | [logstash-filter-prune](https://github.com/logstash-plugins/logstash-filter-prune)logstash-filter-prune                                         |
| [range](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-range)range                                                    | Checks that specified fields stay within given size or length limits                                                       | [logstash-filter-range](https://github.com/logstash-plugins/logstash-filter-range)logstash-filter-range                                         |
| [ruby](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-ruby)ruby                                                       | Executes arbitrary Ruby code                                                                                               | [logstash-filter-ruby](https://github.com/logstash-plugins/logstash-filter-ruby)logstash-filter-ruby                                            |
| [sleep](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-sleep)sleep                                                    | Sleeps for a specified time span                                                                                           | [logstash-filter-sleep](https://github.com/logstash-plugins/logstash-filter-sleep)logstash-filter-sleep                                         |
| [split](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-split)split                                                    | Splits multi-line messages, strings, or arrays into distinct events                                                        | [logstash-filter-split](https://github.com/logstash-plugins/logstash-filter-split)logstash-filter-split                                         |
| [syslog_pri](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-syslog_pri)syslog_pri                                     | Parses the `PRI` (priority) field of a `syslog` message                                                                    | [logstash-filter-syslog_pri](https://github.com/logstash-plugins/logstash-filter-syslog_pri)logstash-filter-syslog_pri                          |
| [threats_classifier](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-threats_classifier)threats_classifier             | Enriches security logs with information about the attacker’s intent                                                        | [logstash-filter-threats_classifier](https://github.com/empow/logstash-filter-threats_classifier)logstash-filter-threats_classifier             |
| [throttle](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-throttle)throttle                                           | Throttles the number of events                                                                                             | [logstash-filter-throttle](https://github.com/logstash-plugins/logstash-filter-throttle)logstash-filter-throttle                                |
| [tld](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-tld)tld                                                          | Replaces the contents of the default message field with whatever you specify in the configuration                          | [logstash-filter-tld](https://github.com/logstash-plugins/logstash-filter-tld)logstash-filter-tld                                               |
| [translate](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-translate)translate                                        | Replaces field contents based on a hash or YAML file                                                                       | [logstash-filter-translate](https://github.com/logstash-plugins/logstash-filter-translate)logstash-filter-translate                             |
| [truncate](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-truncate)truncate                                           | Truncates fields longer than a given length                                                                                | [logstash-filter-truncate](https://github.com/logstash-plugins/logstash-filter-truncate)logstash-filter-truncate                                |
| [urldecode](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-urldecode)urldecode                                        | Decodes URL-encoded fields                                                                                                 | [logstash-filter-urldecode](https://github.com/logstash-plugins/logstash-filter-urldecode)logstash-filter-urldecode                             |
| [useragent](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-useragent)useragent                                        | Parses user agent strings into fields                                                                                      | [logstash-filter-useragent](https://github.com/logstash-plugins/logstash-filter-useragent)logstash-filter-useragent                             |
| [uuid](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-uuid)uuid                                                       | Adds a UUID to events                                                                                                      | [logstash-filter-uuid](https://github.com/logstash-plugins/logstash-filter-uuid)logstash-filter-uuid                                            |
| [wurfl_device_detection](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-wurfl_device_detection)wurfl_device_detection | Enriches logs with device information such as brand, model, OS                                                             | [logstash-filter-wurfl_device_detection](https://github.com/WURFL/logstash-filter-wurfl_device_detection)logstash-filter-wurfl_device_detection |
| [xml](https://docs-v3-preview.elastic.dev/elastic/logstash-docs-md/tree/main/lsr/plugins-filters-xml)xml                                                          | Parses XML into fields                                                                                                     | [logstash-filter-xml](https://github.com/logstash-plugins/logstash-filter-xml)logstash-filter-xml                                               |