This integration collects logs and metrics from Logstash instances.

You can find additional information about monitoring Logstash with the Logstash integration in the Logstash Reference: {{ url "logstash-monitoring-ea" "Monitoring Logstash with Elastic Agent" }}.

The logstash package works with Logstash 8.5.0 and later

Metric collection for the Logstash integration can be done via Elastic Agent (preferred) or with Stack Monitoring. By utilizing Elastic Agent we are able to query additional monitoring APIs and provide additional dashboards, which provide the best view into your Logstash deployment and pipeline execution.

Elastic Agent based metrics collection is not compatible with the Stack Monitoring UI inside Kibana, please only select Metrics (Elastic Agent). Users that prefer the Stack Monitoring UI should uncheck Metrics (Elastic Agent) and continue to use Metrics (Stack Monitoring).

The health report api is available starting with Logstash 8.16.0, which provides the health_report dataset for Node health and Pipeline health dashboards

An example event for 'health_report' looks as following:

{{fields "health_report"}}

{{event "health_report"}}

This is the node dataset, which drives the Node dashboard pages.

{{fields "node_cel"}}

{{event "node_cel"}}

This is the pipeline dataset, which drives the Pipeline dashboard pages.

{{fields "pipeline"}}

{{event "pipeline"}}

This is the plugin dataset, which drives the Pipeline detail dashboard pages. Note that this dataset may produce many documents for logstash instances using a large number of pipelines and/or plugins within those pipelines. For those instances, we recommend reviewing the pipeline collection period, and setting it to an appropriate value.

{{fields "plugins"}}

{{event "plugins"}}

Logstash package supports the plain text format and the JSON format. Also, two types of logs can be activated with the Logstash package:

• log collects and parses the logs that Logstash writes to disk.
• slowlog parses the logstash slowlog (make sure to configure the Logstash slowlog option).

When using the log data stream to parse plaintext logs, if a multiline plaintext log contains an embedded JSON object such that the JSON object starts on a new line, the fileset may not parse the multiline plaintext log event correctly.

Logstash metric related data streams works with Logstash 7.3.0 and later.

{{event "node_stats"}}

Exported fields

{{event "node"}}