Codec plugins
A codec plugin changes the data representation of an event. Codecs are essentially stream filters that can operate as part of an input or output.
The following codec plugins are available below. For a list of Elastic supported plugins, please consult the Support Matrix.
| Plugin | Description | Github repository |
| avro | Reads serialized Avro records as Logstash events | logstash-codec-avro |
| cef | Reads the ArcSight Common Event Format (CEF). | logstash-codec-cef |
| cloudfront | Reads AWS CloudFront reports | logstash-codec-cloudfront |
| cloudtrail | Reads AWS CloudTrail log files | logstash-codec-cloudtrail |
| collectd | Reads events from the collectd binary protocol using UDP. |
logstash-codec-collectd |
| csv | Takes CSV data, parses it, and passes it along. | logstash-codec-csv |
| dots | Sends 1 dot per event to stdout for performance tracking |
logstash-codec-dots |
| edn | Reads EDN format data | logstash-codec-edn |
| edn_lines | Reads newline-delimited EDN format data | logstash-codec-edn_lines |
| es_bulk | Reads the Elasticsearch bulk format into separate events, along with metadata | logstash-codec-es_bulk |
| fluent | Reads the fluentd msgpack schema |
logstash-codec-fluent |
| graphite | Reads graphite formatted lines |
logstash-codec-graphite |
| gzip_lines | Reads gzip encoded content |
logstash-codec-gzip_lines |
| jdots | Renders each processed event as a dot | core plugin |
| java_line | Encodes and decodes line-oriented text data | core plugin |
| java_plain | Processes text data with no delimiters between events | core plugin |
| json | Reads JSON formatted content, creating one event per element in a JSON array | logstash-codec-json |
| json_lines | Reads newline-delimited JSON | logstash-codec-json_lines |
| line | Reads line-oriented text data | logstash-codec-line |
| msgpack | Reads MessagePack encoded content | logstash-codec-msgpack |
| multiline | Merges multiline messages into a single event | logstash-codec-multiline |
| netflow | Reads Netflow v5 and Netflow v9 data | logstash-codec-netflow |
| nmap | Reads Nmap data in XML format | logstash-codec-nmap |
| plain | Reads plaintext with no delimiting between events | logstash-codec-plain |
| protobuf | Reads protobuf messages and converts to Logstash Events | logstash-codec-protobuf |
| rubydebug | Applies the Ruby Awesome Print library to Logstash events | logstash-codec-rubydebug |