logstash-plugin-log-forwarding.mdx

title	tags	metaDescription	redirects	freshnessValidatedDate
Logstash plugin for log forwarding	Logs Enable log management in New Relic Enable log monitoring in New Relic	Install and configure New Relic logging for Logstash, so you can use enhanced log management capabilities.	/docs/enable-new-relic-logging-logstash /docs/enable-new-relic-logs-logstash /docs/logs/new-relic-logs/enable-logs/enable-new-relic-logs-logstash /docs/logs/enable-logs/enable-logs/logstash-plugin-logs /docs/logs/enable-log-monitoring-new-relic/enable-log-monitoring-new-relic/logstash-plugin-log-forwarding /docs/logs/enable-log-management-new-relic/enable-log-monitoring-new-relic/logstash-plugin-log-forwarding	never

If your log data is already being monitored by Logstash, you can use our Logstash plugin to forward and enrich your log data in New Relic.

Forwarding your Logstash logs to New Relic will give you enhanced capabilities to collect, process, explore, query, and alert on your log data.

Enable Logstash for log management [#enable-process]

To forward your logs from Logstash to New Relic:

1. Make sure you have:

   • A New Relic
   • Logstash version 6.6 or higher with Java 8 or Java 11. Use the official Oracle distribution or an open-source distribution such as OpenJDK.

2. Install and configure the Logstash plugin.

3. Optional: Configure additional plugin attributes.

4. Test the Logstash plugin.

5. Generate some traffic and wait a few minutes, then check your account for data.

Install and configure the Logstash plugin [#logstash-plugin]

To forward your logs to New Relic with our Logstash plugin:

1. Enter the following command into your terminal or command line interface:

   logstash-plugin install logstash-output-newrelic

2. In your logstash.conf file, add the following block of data. Be sure to replace the placeholder text with your New Relic .

   output {
     newrelic {
       license_key => "LICENSE_KEY"
     }
   }

3. Restart your Logstash instance.

Optional configuration [#instrument-plugin]

After you install and configure the Logstash plugin, you can use the following attributes to configure how the plugin sends data to New Relic. For more information on adding or configuring attributes, see our Logstash configuration examples in GitHub.

  <th>
    Description
  </th>
</tr>

  <td>
    The number of threads to make requests from. Default: `1`
  </td>
</tr>

<tr>
  <td>
    `base_uri`
  </td>

  <td>
    The New Relic ingestion endpoint.

    * US endpoint: `https://log-api.newrelic.com/log/v1`
    * EU endpoint: `https://log-api.eu.newrelic.com/log/v1`
  </td>
</tr>

<tr>
  <td>
    `max_retries`
  </td>

  <td>
    Maximum number attempts to retry to send a message. If set to `0`, no re-attempts will be made. Default: `3`
  </td>
</tr>

Property
`concurrent_requests`

Test the Logstash plugin [#test-plugin]

To test if your Logstash plugin is receiving input from a log file:

1. Add the following to your logstash.conf file:

   input {
     file {
       path => "/PATH/TO/YOUR/LOG/FILE"
     }
   }

2. Restart your Logstash instance.

3. Run the following command to append a test log message to your log file:

   echo "test message" >> /PATH/TO/YOUR/LOG/FILE

4. Search our logs UI for test message.

View log data [#find-data]

If everything is configured correctly and your data is being collected, you should see log data in both of these places:

• Our logs UI
• Our tools for running NRQL queries. For example, you can execute a query like this:

SELECT * FROM Log

If no data appears after you enable our log management capabilities, follow our standard log troubleshooting procedures.

What's next? [#what-next]

Explore logging data across your platform with our logs UI.

• Get deeper visibility into both your application and your platform performance data by forwarding your logs with our logs in context capabilities.
• Set up alerts.
• Query your data and create dashboards.

Disable log forwarding [#disable]

To disable log forwarding capabilities, follow standard procedures in Logstash documentation. You do not need to do anything else in New Relic.