Logstash - transport and process your logs, events, or other data
Ruby Java Shell HTML PowerShell Batchfile Other
Latest commit 568666c Dec 15, 2016 @colinsurprenant colinsurprenant add queue drain option support
wip queue drain option

metrics on empty batches

reenabled spec

cosmetic fixes

stats collection, mutex, specs, empty batch handling

Failed to load latest commit information.
.github Move Contributors for more visibility May 20, 2016
bin Update pleaserun and system-install Feb 9, 2017
ci Support params to specify output dir Feb 9, 2017
config config/logstash.yml: Remove trailing whitespace Feb 13, 2017
data add data.path setting Jun 24, 2016
docs Update setting-up-logstash.asciidoc Feb 28, 2017
gradle/wrapper Migrate Logstash to Log4j2 Logging (#5651) Aug 25, 2016
lib Open file in binary mode. Feb 6, 2017
logstash-core-event-java unify gradle projects (#6725) Feb 27, 2017
logstash-core-event Bump master to 6.0.0-alpha1 (#5880) Sep 8, 2016
logstash-core-plugin-api bump plugin version to match RubyGems.org (#5909) Sep 14, 2016
logstash-core-queue-jruby add queue drain option support Mar 1, 2017
logstash-core add queue drain option support Mar 1, 2017
pkg Truncate from the end of the message instead of the front. Nov 15, 2016
qa introduce locking in path.data Feb 24, 2017
rakelib unify gradle projects (#6725) Feb 27, 2017
spec Ignore NIL/EMPTY values for LOGSTASH_PACK_URL environment variable Feb 2, 2017
tools [docs gen] Format description to be at the right level Feb 19, 2017
.gitignore unify gradle projects (#6725) Feb 27, 2017
.travis.yml Run integration tests separately Feb 16, 2017
CHANGELOG move changelog to markdown and added link Jun 15, 2015
CHANGELOG.md Changelog for 1.5.5 and 2.0 Oct 29, 2015
CONTRIBUTING.md Fix P1 definition to include test failures May 20, 2016
CONTRIBUTORS ElasticSearch output plugin to support multiple hosts and enhance sta… Oct 10, 2014
Gemfile make dissect filter a default plugin Feb 18, 2017
LICENSE Generate notice file during artifact build (#6538) Jan 16, 2017
NOTICE.TXT make dissect filter a default plugin Feb 18, 2017
README.md Fix stack link Nov 28, 2016
ROADMAP.md New roadmap page May 20, 2016
Rakefile fix version path, relates to #4123 Nov 17, 2015
STYLE.md Update STYLE.md Mar 11, 2016
build.gradle unify gradle projects (#6725) Feb 27, 2017
dripmain.rb merge feature/java_persistence into master Nov 1, 2016
gradlew Migrate Logstash to Log4j2 Logging (#5651) Aug 25, 2016
gradlew.bat Migrate Logstash to Log4j2 Logging (#5651) Aug 25, 2016
settings.gradle unify gradle projects (#6725) Feb 27, 2017
versions.yml make sure jruby queue is on 6.0.0 alpha1 Dec 8, 2016



Build status

Test master 5.0 2.4
core Build Status Build Status Build Status

Logstash is part of the Elastic Stack along with Beats, Elasticsearch and Kibana. Logstash is an open source, server-side data processing pipeline that ingests data from a multitude of sources simultaneously, transforms it, and then sends it to your favorite "stash." (Ours is Elasticsearch, naturally.). Logstash has over 200 plugins, and you can write your own very easily as well.

The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.

For more info, see https://www.elastic.co/products/logstash

Documentation and Getting Started

You can find the documentation and getting started guides for Logstash on the elastic.co site


You can download Logstash binaries, as well as debian/rpm packages for the supported platforms, from downloads page.

Need Help?

Logstash Plugins

Logstash plugins are hosted in separate repositories under under the logstash-plugins github organization. Each plugin is a self-contained Ruby gem which gets published to RubyGems.org.

Writing your own Plugin

Logstash is known for its extensibility. There are hundreds of plugins for Logstash and you can write your own very easily! For more info on developing and testing these plugins, please see the working with plugins section

Plugin Issues and Pull Requests

Please open new issues and pull requests for plugins under its own repository

For example, if you have to report an issue/enhancement for the Elasticsearch output, please do so here.

Logstash core will continue to exist under this repository and all related issues and pull requests can be submitted here.

Developing Logstash Core


  • Install JDK version 8
  • Install JRuby 1.7.x.
  • Install rake and bundler tool using gem install rake and gem install bundler respectively.

On Windows make sure to set the JAVA_HOME environment variable to the path to your JDK installation directory. For example set JAVA_HOME=<JDK_PATH>

Vendored JRuby: Logstash uses JRuby which gets embedded in the vendor/jruby/ directory. It is recommended to use a Ruby version manager such as RVM or rbenv.

  • To run Logstash from the repo you must first bootstrap the environment:
rake bootstrap
  • You can then use bin/logstash to start Logstash, but there are no plugins installed. Logstash ships with default plugins. To install those, you can run:
rake plugin:install-default
  • Alternatively, you can only install the core plugins required to run the tests
rake test:install-core

To verify your environment, run

bin/logstash -e 'input { stdin { } } output { stdout {} }'

This should start Logstash with stdin input waiting for you to enter an event

hello world
2016-11-11T01:22:14.405+0000 hello world

Drip Launcher

Drip is a tool that solves the slow JVM startup problem while developing Logstash. The drip script is intended to be a drop-in replacement for the java command. We recommend using drip during development, in particular for running tests. Using drip, the first invocation of a command will not be faster but the subsequent commands will be swift.

To tell logstash to use drip, either set the USE_DRIP=1 environment variable or set JAVACMD=`which drip`.


USE_DRIP=1 bin/rspec


Drip does not work with STDIN. You cannot use drip for running configs which use the stdin plugin.


For testing you can use the test rake tasks and the bin/rspec command, see instructions below. Note that the bin/logstash rspec command has been replaced by bin/rspec.

Core tests

1- In order to run the core tests, a small set of plugins must first be installed:

rake test:install-core

2- To run the logstash core tests you can use the rake task:

rake test:core

or use the rspec tool to run all tests or run a specific test:

bin/rspec spec/foo/bar_spec.rb

Plugins tests

To run the tests of all currently installed plugins:

rake test:plugin

You can install the default set of plugins included in the logstash package or all plugins:

rake test:install-default
rake test:install-all

Note that if a plugin is installed using the plugin manager bin/logstash-plugin install ... do not forget to also install the plugins development dependencies using the following command after the plugin installation:

bin/logstash-plugin install --development

Building Artifacts

You can build a Logstash snapshot package as tarball or zip file

rake artifact:tar
rake artifact:zip

This will create the artifact LS_HOME/build directory

You can also build .rpm and .deb, but the fpm tool is required.

rake artifact:rpm
rake artifact:deb

Project Principles

  • Community: If a newbie has a bad time, it's a bug.
  • Software: Make it work, then make it right, then make it fast.
  • Technology: If it doesn't do a thing today, we can make it do it tomorrow.


All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.

Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.

It is more important to me that you are able to contribute.

For more information about contributing, see the CONTRIBUTING file.