- Logstash Reference: other versions:
- Logstash Introduction
- Getting Started with Logstash
- How Logstash Works
- Setting Up and Running Logstash
- Setting Up X-Pack
- Breaking Changes
- X-Pack Breaking Changes
- Upgrading Logstash
- Configuring Logstash
- Structure of a Config File
- Accessing Event Data and Fields in the Configuration
- Using Environment Variables in the Configuration
- Logstash Configuration Examples
- Multiple Pipelines
- Reloading the Config File
- Managing Multiline Events
- Glob Pattern Support
- Converting Ingest Node Pipelines
- Configuring Logstash-to-Logstash Communication
- Managing Logstash
- Working with Logstash Modules
- Working with Filebeat Modules
- Data Resiliency
- Transforming Data
- Deploying and Scaling Logstash
- Performance Tuning
- Monitoring Logstash
- Monitoring APIs
- Working with plugins
- Input plugins
- beats
- cloudwatch
- couchdb_changes
- dead_letter_queue
- elasticsearch
- exec
- file
- ganglia
- gelf
- generator
- github
- google_pubsub
- graphite
- heartbeat
- http
- http_poller
- imap
- irc
- jdbc
- jms
- jmx
- kafka
- kinesis
- log4j
- lumberjack
- meetup
- pipe
- puppet_facter
- rabbitmq
- redis
- relp
- rss
- s3
- salesforce
- snmptrap
- sqlite
- sqs
- stdin
- stomp
- syslog
- tcp
- udp
- unix
- varnishlog
- websocket
- wmi
- xmpp
- Output plugins
- boundary
- circonus
- cloudwatch
- csv
- datadog
- datadog_metrics
- elasticsearch
- exec
- file
- ganglia
- gelf
- google_bigquery
- graphite
- graphtastic
- http
- influxdb
- irc
- juggernaut
- kafka
- librato
- loggly
- lumberjack
- metriccatcher
- mongodb
- nagios
- nagios_nsca
- opentsdb
- pagerduty
- pipe
- rabbitmq
- redis
- redmine
- riak
- riemann
- s3
- sns
- solr_http
- sqs
- statsd
- stdout
- stomp
- syslog
- tcp
- timber
- udp
- webhdfs
- websocket
- xmpp
- zabbix
- Filter plugins
- aggregate
- alter
- cidr
- cipher
- clone
- csv
- date
- de_dot
- dissect
- dns
- drop
- elapsed
- elasticsearch
- environment
- extractnumbers
- fingerprint
- geoip
- grok
- i18n
- jdbc_static
- jdbc_streaming
- json
- json_encode
- kv
- metricize
- metrics
- mutate
- prune
- range
- ruby
- sleep
- split
- syslog_pri
- throttle
- tld
- translate
- truncate
- urldecode
- useragent
- uuid
- xml
- Codec plugins
- Contributing to Logstash
- How to write a Logstash input plugin
- How to write a Logstash input plugin
- How to write a Logstash codec plugin
- How to write a Logstash filter plugin
- Contributing a Patch to a Logstash Plugin
- Logstash Plugins Community Maintainer Guide
- Submitting your plugin to RubyGems.org and the logstash-plugins repository
- Glossary of Terms
- Release Notes
- X-Pack Release Notes
- Logstash X-Pack 6.2.4 Release Notes
- Logstash X-Pack 6.2.3 Release Notes
- Logstash X-Pack 6.2.2 Release Notes
- Logstash X-Pack 6.2.1 Release Notes
- Logstash X-Pack 6.2.0 Release Notes
- Logstash X-Pack 6.1.4 Release Notes
- Logstash X-Pack 6.1.3 Release Notes
- Logstash X-Pack 6.1.2 Release Notes
- Logstash X-Pack 6.1.1 Release Notes
- Logstash X-Pack 6.1.0 Release Notes
After you install Logstash, you can optionally obtain and install X-Pack. For more information about how to obtain X-Pack, see https://www.elastic.co/products/x-pack.
To use X-Pack you need:
- Elasticsearch 6.2.4 - Installing Elasticsearch
- Kibana 6.2.4 - Getting Kibana Up and Running
You must install X-Pack on Elasticsearch, Kibana, and Logstash, using the version of X-Pack that matches of the version the product. See the Elastic Support Matrix for more information about product compatibility.
If you are installing X-Pack for the first time on an existing cluster, you must perform a full cluster restart. Installing X-Pack enables security and security must be enabled on ALL nodes in a cluster for the cluster to operate correctly. When upgrading you can usually perform a rolling upgrade.
The following diagram provides an overview of the steps that are required to set up X-Pack on Logstash:

To install X-Pack on Logstash:
- Install X-Pack on Elasticsearch.
- Install X-Pack on Kibana.
-
Optional: If you want to install X-Pack on a machine that doesn’t have internet access:
-
Manually download the X-Pack zip file:
https://artifacts.elastic.co/downloads/packs/x-pack/x-pack-6.2.4.zip
(sha512)The plugins for Elasticsearch, Kibana, and Logstash are included in the same zip file. If you have already downloaded this file to install X-Pack on one of those other products, you can reuse the same file.
- Transfer the zip file to a temporary directory on the offline machine. (Do NOT put the file in the Elasticsearch plugins directory.)
-
-
Run
bin/logstash-plugin install
from the Logstash installation directory.bin/logstash-plugin install x-pack
The plugin install scripts require direct internet access to download and install X-Pack. If your server doesn’t have internet access, specify the location of the X-Pack zip file that you downloaded to a temporary directory.
bin/logstash-plugin install file:///path/to/file/x-pack-6.2.4.zip
-
Update Logstash to use the new password for the built-in
logstash_system
user, which you set up along with the other built-in users when you installed X-Pack on Elasticsearch. You must configure thexpack.monitoring.elasticsearch.password
setting in thelogstash.yml
configuration file with the new password for thelogstash_system
user.xpack.monitoring.elasticsearch.username: logstash_system xpack.monitoring.elasticsearch.password: logstashpassword
For more information, see Setting Up User Authentication.
- Configure and start Logstash.