- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Setting Up X-Pack
- Breaking Changes
- X-Pack Breaking Changes
- Upgrading Logstash
- Configuring Logstash
- Structure of a Config File
- Accessing Event Data and Fields in the Configuration
- Using Environment Variables in the Configuration
- Logstash Configuration Examples
- Multiple Pipelines
- Reloading the Config File
- Managing Multiline Events
- Glob Pattern Support
- Converting Ingest Node Pipelines
- Configuring Logstash-to-Logstash Communication
- Managing Logstash
- Working with Logstash Modules
- Working with Filebeat Modules
- Data Resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Monitoring APIs
- Working with plugins
- Input plugins
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- jdbc
- jms
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- salesforce
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- graphite
- graphtastic
- http
- influxdb
- irc
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- aggregate
- alter
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- i18n
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- xml
- Codec plugins
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- Contributing a Patch to a Logstash Plugin
- Logstash Plugins Community Maintainer Guide
- Submitting your plugin to RubyGems.org and the logstash-plugins repository
- Glossary of Terms
- Release Notes
- X-Pack Release Notes
- Logstash X-Pack 6.2.4 Release Notes
- Logstash X-Pack 6.2.3 Release Notes
- Logstash X-Pack 6.2.2 Release Notes
- Logstash X-Pack 6.2.1 Release Notes
- Logstash X-Pack 6.2.0 Release Notes
- Logstash X-Pack 6.1.4 Release Notes
- Logstash X-Pack 6.1.3 Release Notes
- Logstash X-Pack 6.1.2 Release Notes
- Logstash X-Pack 6.1.1 Release Notes
- Logstash X-Pack 6.1.0 Release Notes
Before version 1.5, Logstash included all plugins in each release. This made it easy to make use of any plugin, but it complicated plugin development—a new release of Logstash became necessary if a plugin needed patching. Since version 1.5, all plugins are independent of the Logstash core. Now you can add your own input, codec, filter, or output plugins to Logstash much more easily!
Since plugins can now be developed and deployed independently of the Logstash core, there are documents which guide you through the process of coding and deploying your own plugins:
Starting in Logstash 2.0, we changed how input plugins shut down to increase shutdown reliability. There are three methods
for plugin shutdown: stop, stop?, and close.
-
Call the
stopmethod from outside the plugin thread. This method signals the plugin to stop. -
The
stop?method returnstruewhen thestopmethod has already been called for that plugin. -
The
closemethod performs final bookkeeping and cleanup after the plugin’srunmethod and the plugin’s thread both exit. Theclosemethod is a a new name for the method known asteardownin previous versions of Logstash.
The shutdown, finished, finished?, running?, and terminating? methods are redundant and no longer present in the
Plugin Base class.
Sample code for the plugin shutdown APIs is available.
We also welcome contributions and bug fixes to the Logstash core feature set.
Please read through our contribution guide, and the Logstash readme document.