-
Notifications
You must be signed in to change notification settings - Fork 70
/
Copy pathlogstash-output.html
654 lines (607 loc) · 37 KB
/
logstash-output.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
<!DOCTYPE html>
<html lang="en-us">
<head>
<meta charset="UTF-8">
<title>Configure the Logstash output | APM Server Reference [7.15] | Elastic</title>
<meta class="elastic" name="content" content="Configure the Logstash output | APM Server Reference [7.15]">
<link rel="home" href="index.html" title="APM Server Reference [7.15]"/>
<link rel="up" href="configuring-output.html" title="Configure the output"/>
<link rel="prev" href="elasticsearch-output.html" title="Configure the Elasticsearch output"/>
<link rel="next" href="kafka-output.html" title="Configure the Kafka output"/>
<meta class="elastic" name="product_version" content="7.15"/>
<meta class="elastic" name="product_name" content="APM"/>
<meta class="elastic" name="website_area" content="documentation"/>
<meta name="DC.type" content="Learn/Docs/APM Server/Reference/7.15"/>
<meta name="DC.subject" content="APM"/>
<meta name="DC.identifier" content="7.15"/>
<meta name="robots" content="noindex,nofollow"/>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<script src="https://cdn.optimizely.com/js/18132920325.js"></script>
<link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
<link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
<link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
<link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
<link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
<link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
<link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
<link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
<link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
<link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
<link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
<link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
<link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
<link rel="manifest" href="/manifest.json">
<meta name="apple-mobile-web-app-title" content="Elastic">
<meta name="application-name" content="Elastic">
<meta name="msapplication-TileColor" content="#ffffff">
<meta name="msapplication-TileImage" content="/mstile-144x144.png">
<meta name="theme-color" content="#ffffff">
<meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd" />
<meta name="yandex-verification" content="d8a47e95d0972434" />
<meta name="localized" content="true" />
<meta name="st:robots" content="follow,index" />
<meta property="og:image" content="https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt280217a63b82a734/6202d3378b1f312528798412/elastic-logo.svg" />
<meta property="og:image:width" content="500" />
<meta property="og:image:height" content="172" />
<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
<link rel="icon" href="/favicon.ico" type="image/x-icon">
<link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
<link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
<link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
<!-- Give IE8 a fighting chance -->
<!--[if lt IE 9]>
<script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
<script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
<![endif]-->
<link rel="stylesheet" type="text/css" href="/guide/static/styles-v1.css" />
</head>
<!--© 2015-2025 Elasticsearch B.V. -->
<!-- All Elastic documentation is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. -->
<!-- http://creativecommons.org/licenses/by-nc-nd/4.0/ -->
<body>
<!-- Google Tag Manager -->
<script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
<!-- End Google Tag Manager -->
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-12395217-16');
</script>
<!-- Google Tag Manager for GA4 -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-KNJMG2M');</script>
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KNJMG2M" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager for GA4-->
<div id='elastic-nav' style="display:none;"></div>
<script src='https://www.elastic.co/elastic-nav.js'></script>
<div class="main-container">
<section id="content" >
<div class="content-wrapper">
<section id="guide" lang="en">
<div class="container-fluid">
<div class="row pb-3">
<div class="col-12 order-2 col-md-4 order-md-1 col-lg-3 h-almost-full-md sticky-top-md" id="left_col">
<!-- The TOC is appended here -->
</div>
<div class="col-12 order-1 col-md-8 order-md-2 col-lg-7 order-lg-2 guide-section" id="middle_col">
<!-- start body -->
<div class="page_header">
The Elastic APM integration became generally available in 7.16 — see the <a href="https://www.elastic.co/guide/en/apm/guide/current/index.html">APM Guide</a> for updated documentation. Standalone APM Server users can see the <a href="https://www.elastic.co/guide/en/apm/guide/current/legacy-apm-overview.html" title="Legacy APM Overview">Legacy APM Overview</a> and <a href="https://www.elastic.co/guide/en/apm/guide/current/overview.html" title="Legacy APM Server Reference">Legacy APM Server Reference</a>.
</div>
<div class="navheader">
<span class="prev">
<a href="elasticsearch-output.html">« Configure the Elasticsearch output</a>
</span>
<span class="next">
<a href="kafka-output.html">Configure the Kafka output »</a>
</span>
</div>
<div class="book" lang="en">
<div class="titlepage">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="/guide/">Elastic Docs</a></span>
<span class="chevron-right">›</span><span class="breadcrumb-link">
<div id="related-products" class="dropdown">
<div class="related-products-title">APM:</div>
<div class="dropdown-anchor" tabindex="0">Server Reference<span class="dropdown-icon"></span></div>
<div class="dropdown-content">
<ul>
<li class="dropdown-category">APM</li>
<ul>
<li><a href="/guide/en/observability/current/apm.html">Observability › APM</a></li>
</ul>
<li class="dropdown-category">APM agents</li>
<ul>
<li><a href="/guide/en/apm/agent/android/current/intro.html">Android Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/go/current/introduction.html">Go Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/swift/current/intro.html">iOS Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/java/current/intro.html">Java Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/dotnet/current/intro.html">.NET Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/nodejs/current/intro.html">Node.js Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/php/current/intro.html">PHP Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/python/current/getting-started.html">Python Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/ruby/current/introduction.html">Ruby Agent Reference</a></li>
<li><a href="/guide/en/apm/agent/rum-js/current/intro.html">Real User Monitoring JavaScript Agent Reference</a></li>
</ul>
<li class="dropdown-category">APM extensions</li>
<ul>
<li><a href="/guide/en/apm/lambda/current/aws-lambda-arch.html">AWS Lambda extension</a></li>
<li><a href="/guide/en/apm/attacher/current/apm-attacher.html">Attacher</a></li>
</ul>
</ul>
</div>
</div>
<span class="chevron-right">›</span><span class="breadcrumb-link"><a href="configuring-howto-apm-server.html">Configure APM Server</a></span>
<span class="chevron-right">›</span><span class="breadcrumb-link"><a href="configuring-output.html">Configure the output</a></span>
</div>
<div>
<div><h1 class="title"><a id="id-1"></a>Configure the Logstash output</h1><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div>
<!--EXTRA-->
</div>
<div id="content">
<div id="url-to-v3" class="version-warning">
<strong>IMPORTANT</strong>: This documentation is no longer updated. Refer to <a href="https://www.elastic.co/support/eol">Elastic's version policy</a> and the <a href="https://www.elastic.co/docs">latest documentation</a>.
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h2 class="title"><a id="logstash-output"></a>Configure the Logstash output</h2><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The Logstash output sends events directly to Logstash by using the lumberjack
protocol, which runs over TCP. Logstash allows for additional processing and routing of
generated events.</p>
<div class="important admon">
<div class="icon"></div>
<div class="admon_content">
<p class="admon_title">Prerequisite</p>
<p>To send events to Logstash, you also need to create a Logstash configuration pipeline
that listens for incoming Beats connections and indexes the received events into
Elasticsearch. For more information, see
<a href="/guide/en/logstash/7.15/getting-started-with-logstash.html" class="ulink" target="_top">Getting Started with Logstash</a>.
Also see the documentation for the
<a href="/guide/en/logstash/7.15/plugins-inputs-beats.html" class="ulink" target="_top">Beats input</a> and
<a href="/guide/en/logstash/7.15/plugins-outputs-elasticsearch.html" class="ulink" target="_top">Elasticsearch output</a> plugins.</p>
</div>
</div>
<p>If you want to use Logstash to perform additional processing on the data collected by
APM Server, you need to configure APM Server to use Logstash.</p>
<p>To do this, edit the APM Server configuration file to disable the Elasticsearch
output by commenting it out and enable the Logstash output by uncommenting the
Logstash section:</p>
<div class="pre_wrapper lang-yaml">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-yaml">output.logstash:
hosts: ["127.0.0.1:5044"]</pre>
</div>
<p>The <code class="literal">hosts</code> option specifies the Logstash server and the port (<code class="literal">5044</code>) where Logstash is configured to listen for incoming
Beats connections.</p>
<p>For this configuration, you must <a class="xref" href="apm-server-template.html#load-template-manually" title="Load the index template manually">load the index template into Elasticsearch manually</a>
because the options for auto loading the template are only available for the Elasticsearch output.</p>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h3 class="title"><a id="_accessing_metadata_fields"></a>Accessing metadata fields</h3><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>Every event sent to Logstash contains the following metadata fields that you can
use in Logstash for indexing and filtering:</p>
<div class="pre_wrapper lang-json">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-json">{
...
"@metadata": { <a id="CO8-1"></a><i class="conum" data-value="1"></i>
"beat": "apm", <a id="CO8-2"></a><i class="conum" data-value="2"></i>
"pipeline":"apm", <a id="CO8-3"></a><i class="conum" data-value="3"></i>
"version": "7.15.2" <a id="CO8-4"></a><i class="conum" data-value="4"></i>
}
}</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO8-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>APM Server uses the <code class="literal">@metadata</code> field to send metadata to Logstash. See the
<a href="/guide/en/logstash/7.15/event-dependent-configuration.html#metadata" class="ulink" target="_top">Logstash documentation</a>
for more about the <code class="literal">@metadata</code> field.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO8-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>The default is apm. To change this value, set the
<a class="xref" href="logstash-output.html#logstash-index" title="index"><code class="literal">index</code></a> option in the APM Server config file.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO8-3"><i class="conum" data-value="3"></i></a></p>
</td>
<td align="left" valign="top">
<p>The default pipeline configuration: <code class="literal">apm</code>. Additional pipelines can be enabled
with a <a href="/guide/en/logstash/7.15/use-ingest-pipelines.html" class="ulink" target="_top">Logstash pipeline config</a>.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO8-4"><i class="conum" data-value="4"></i></a></p>
</td>
<td align="left" valign="top">
<p>The current version of APM Server.</p>
</td>
</tr>
</table>
</div>
<p>In addition to metadata, APM Server provides the <code class="literal">processor.event</code> field, which
can be used to separate <a href="/guide/en/apm/get-started/7.15/apm-data-model.html" class="ulink" target="_top">event types</a> into different indices.</p>
<p>For example, the following Logstash configuration file tells
Logstash to use the index and event types reported by APM Server for indexing events
into Elasticsearch:</p>
<div class="pre_wrapper lang-logstash">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-logstash">input {
beats {
port => 5044
}
}
filter {
if [@metadata][beat] == "apm" {
if [processor][event] == "sourcemap" {
mutate {
add_field => { "[@metadata][index]" => "%{[@metadata][beat]}-%{[@metadata][version]}-%{[processor][event]}" } <a id="CO9-1"></a><i class="conum" data-value="1"></i>
}
} else {
mutate {
add_field => { "[@metadata][index]" => "%{[@metadata][beat]}-%{[@metadata][version]}-%{[processor][event]}-%{+yyyy.MM.dd}" } <a id="CO9-2"></a><i class="conum" data-value="2"></i>
}
}
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "%{[@metadata][index]}"
}
}</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>Creates a new field named <code class="literal">@metadata.index</code>.
<code class="literal">%{[@metadata][beat]}</code> sets the first part of the index name to the value of the <code class="literal">metadata.beat</code> field.
<code class="literal">%{[@metadata][version]}</code> sets the second part to APM Server’s version.
<code class="literal">%{[processor][event]}</code> sets the final part based on the APM event type.
For example: <code class="literal">apm-7.15.2-sourcemap</code>.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO9-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>In addition to the above rules, this pattern appends a date to the <code class="literal">index</code> name so Logstash creates a new index each day.
For example: <code class="literal">apm-7.15.2-transaction-2019.10.20</code>.</p>
</td>
</tr>
</table>
</div>
<p>Events indexed into Elasticsearch with the Logstash configuration shown here
will be similar to events directly indexed by APM Server into Elasticsearch.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h3 class="title"><a id="_logstash_and_ilm"></a>Logstash and ILM</h3><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>When used with <a href="/guide/en/apm/server/7.15/ilm.html" class="ulink" target="_top">Index lifecycle management</a>, Logstash does not need to create a new index each day.
Here’s a sample Logstash configuration file that would accomplish this:</p>
<div class="pre_wrapper lang-logstash">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-logstash">input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{[processor][event]}" <a id="CO10-1"></a><i class="conum" data-value="1"></i>
}
}</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO10-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>Outputs documents to an index:
<code class="literal">%{[@metadata][beat]}</code> sets the first part of the index name to the value of the <code class="literal">metadata.beat</code> field.
<code class="literal">%{[@metadata][version]}</code> sets the second part to APM Server’s version.
<code class="literal">%{[processor][event]}</code> sets the final part based on the APM event type.
For example: <code class="literal">apm-7.15.2-sourcemap</code>.</p>
</td>
</tr>
</table>
</div>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h3 class="title"><a id="_compatibility_2"></a>Compatibility</h3><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>This output works with all compatible versions of Logstash. See the
<a href="/support/matrix#matrix_compatibility" class="ulink" target="_top">Elastic Support
Matrix</a>.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h3 class="title"><a id="_configuration_options_5"></a>Configuration options</h3><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>You can specify the following options in the <code class="literal">logstash</code> section of the
<code class="literal">apm-server.yml</code> config file:</p>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_enabled_4"></a><code class="literal">enabled</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The enabled config is a boolean setting to enable or disable the output. If set
to false, the output is disabled.</p>
<p>The default value is <code class="literal">false</code>.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="hosts"></a><code class="literal">hosts</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The list of known Logstash servers to connect to. If load balancing is disabled, but
multiple hosts are configured, one host is selected randomly (there is no precedence).
If one host becomes unreachable, another one is selected randomly.</p>
<p>All entries in this list can contain a port number. The default port number 5044 will be used if no number is given.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_compression_level_2"></a><code class="literal">compression_level</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The gzip compression level. Setting this value to 0 disables compression.
The compression level must be in the range of 1 (best speed) to 9 (best compression).</p>
<p>Increasing the compression level will reduce the network usage but will increase the CPU usage.</p>
<p>The default value is 3.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_escape_html_2"></a><code class="literal">escape_html</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>Configure escaping of HTML in strings. Set to <code class="literal">true</code> to enable escaping.</p>
<p>The default value is <code class="literal">false</code>.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_worker_2"></a><code class="literal">worker</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The number of workers per configured host publishing events to Logstash. This
is best used with load balancing mode enabled. Example: If you have 2 hosts and
3 workers, in total 6 workers are started (3 for each host).</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="loadbalance"></a><code class="literal">loadbalance</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>If set to true and multiple Logstash hosts are configured, the output plugin
load balances published events onto all Logstash hosts. If set to false,
the output plugin sends all events to only one host (determined at random) and
will switch to another host if the selected one becomes unresponsive. The default value is false.</p>
<div class="pre_wrapper lang-yaml">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-yaml">output.logstash:
hosts: ["localhost:5044", "localhost:5045"]
loadbalance: true
index: apm-server</pre>
</div>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_ttl"></a><code class="literal">ttl</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>Time to live for a connection to Logstash after which the connection will be re-established.
Useful when Logstash hosts represent load balancers. Since the connections to Logstash hosts
are sticky, operating behind load balancers can lead to uneven load distribution between the instances.
Specifying a TTL on the connection allows to achieve equal connection distribution between the
instances. Specifying a TTL of 0 will disable this feature.</p>
<p>The default value is 0.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>The "ttl" option is not yet supported on an async Logstash client (one with the "pipelining" option set).</p>
</div>
</div>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_pipelining"></a><code class="literal">pipelining</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>Configures the number of batches to be sent asynchronously to Logstash while waiting
for ACK from Logstash. Output only becomes blocking once number of <code class="literal">pipelining</code>
batches have been written. Pipelining is disabled if a value of 0 is
configured. The default value is 2.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_proxy_url_2"></a><code class="literal">proxy_url</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The URL of the SOCKS5 proxy to use when connecting to the Logstash servers. The
value must be a URL with a scheme of <code class="literal">socks5://</code>. The protocol used to
communicate to Logstash is not based on HTTP so a web-proxy cannot be used.</p>
<p>If the SOCKS5 proxy server requires client authentication, then a username and
password can be embedded in the URL as shown in the example.</p>
<p>When using a proxy, hostnames are resolved on the proxy server instead of on the
client. You can change this behavior by setting the
<a class="xref" href="logstash-output.html#logstash-proxy-use-local-resolver" title="proxy_use_local_resolver"><code class="literal">proxy_use_local_resolver</code></a> option.</p>
<div class="pre_wrapper lang-yaml">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-yaml">output.logstash:
hosts: ["remote-host:5044"]
proxy_url: socks5://user:password@socks5-proxy:2233</pre>
</div>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="logstash-proxy-use-local-resolver"></a><code class="literal">proxy_use_local_resolver</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The <code class="literal">proxy_use_local_resolver</code> option determines if Logstash hostnames are
resolved locally when using a proxy. The default value is false, which means
that when a proxy is used the name resolution occurs on the proxy server.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="logstash-index"></a><code class="literal">index</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The index root name to write events to. The default is the Beat name. For
example <code class="literal">"apm"</code> generates <code class="literal">"[apm-]7.15.2-YYYY.MM.DD"</code>
indices (for example, <code class="literal">"apm-7.15.2-2017.04.26"</code>).</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>This parameter’s value will be assigned to the <code class="literal">metadata.beat</code> field. It
can then be accessed in Logstash’s output section as <code class="literal">%{[@metadata][beat]}</code>.</p>
</div>
</div>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_ssl_2"></a><code class="literal">ssl</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>Configuration options for SSL parameters like the root CA for Logstash connections. See
<a class="xref" href="configuration-ssl.html" title="SSL output settings">SSL output settings</a> for more information. To use SSL, you must also configure the
<a href="/guide/en/logstash/current/plugins-inputs-beats.html" class="ulink" target="_top">Beats input plugin for Logstash</a> to use SSL/TLS.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_timeout_2"></a><code class="literal">timeout</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The number of seconds to wait for responses from the Logstash server before timing out. The default is 30 (seconds).</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_max_retries_2"></a><code class="literal">max_retries</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The number of times to retry publishing an event after a publishing failure.
After the specified number of retries, the events are typically dropped.</p>
<p>Set <code class="literal">max_retries</code> to a value less than 0 to retry until all events are published.</p>
<p>The default is 3.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_bulk_max_size_2"></a><code class="literal">bulk_max_size</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The maximum number of events to bulk in a single Logstash request. The default is 2048.</p>
<p>If the Beat sends single events, the events are collected into batches. If the Beat publishes
a large batch of events (larger than the value specified by <code class="literal">bulk_max_size</code>), the batch is
split.</p>
<p>Specifying a larger batch size can improve performance by lowering the overhead of sending events.
However big batch sizes can also increase processing times, which might result in
API errors, killed connections, timed-out publishing requests, and, ultimately, lower
throughput.</p>
<p>Setting <code class="literal">bulk_max_size</code> to values less than or equal to 0 disables the
splitting of batches. When splitting is disabled, the queue decides on the
number of events to be contained in a batch.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_slow_start"></a><code class="literal">slow_start</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>If enabled, only a subset of events in a batch of events is transferred per transaction.
The number of events to be sent increases up to <code class="literal">bulk_max_size</code> if no error is encountered.
On error, the number of events per transaction is reduced again.</p>
<p>The default is <code class="literal">false</code>.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_backoff_init_2"></a><code class="literal">backoff.init</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The number of seconds to wait before trying to reconnect to Logstash after
a network error. After waiting <code class="literal">backoff.init</code> seconds, APM Server tries to
reconnect. If the attempt fails, the backoff timer is increased exponentially up
to <code class="literal">backoff.max</code>. After a successful connection, the backoff timer is reset. The
default is 1s.</p>
</div>
<div class="section">
<div class="titlepage"><div><div>
<div class="position-relative"><h4 class="title"><a id="_backoff_max_2"></a><code class="literal">backoff.max</code></h4><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/7.15/docs/copied-from-beats/outputs/logstash/docs/logstash.asciidoc">edit</a></div>
</div></div></div>
<p>The maximum number of seconds to wait before attempting to connect to
Logstash after a network error. The default is 60s.</p>
</div>
</div>
</div>
</div>
</div><div class="navfooter">
<span class="prev">
<a href="elasticsearch-output.html">« Configure the Elasticsearch output</a>
</span>
<span class="next">
<a href="kafka-output.html">Configure the Kafka output »</a>
</span>
</div>
<!-- end body -->
</div>
<div class="col-12 order-3 col-lg-2 order-lg-3 h-almost-full-lg sticky-top-lg" id="right_col">
<div id="sticky_content">
<!-- The OTP is appended here -->
<div class="row">
<div class="col-0 col-md-4 col-lg-0" id="bottom_left_col"></div>
<div class="col-12 col-md-8 col-lg-12">
<div id="rtpcontainer">
<div class="mktg-promo" id="most-popular">
<p class="aside-heading">Most Popular</p>
<div class="pb-2">
<p class="media-type">Video</p>
<a href="https://www.elastic.co/webinars/getting-started-elasticsearch?page=docs&placement=top-video">
<p class="mb-0">Get Started with Elasticsearch</p>
</a>
</div>
<div class="pb-2">
<p class="media-type">Video</p>
<a href="https://www.elastic.co/webinars/getting-started-kibana?page=docs&placement=top-video">
<p class="mb-0">Intro to Kibana</p>
</a>
</div>
<div class="pb-2">
<p class="media-type">Video</p>
<a href="https://www.elastic.co/webinars/introduction-elk-stack?page=docs&placement=top-video">
<p class="mb-0">ELK for Logs & Metrics</p>
</a>
</div>
</div>
</div>
<!-- Feedback widget -->
<div id="feedbackWidgetContainer"></div>
</div>
</div>
</div>
</div>
</div>
</div>
</section>
</div>
<div id='elastic-footer'></div>
<script src='https://www.elastic.co/elastic-footer.js'></script>
<!-- Footer Section end-->
</section>
</div>
<!-- Feedback modal -->
<div id="feedbackModalContainer"></div>
<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs-v1.js"></script>
<script type="text/javascript">
window.initial_state = {}</script>
</body>
</html>