Logstash

Ingest pipeline that collects, transforms and ships events to Elasticsearch and other sinks.

Provider: default
Kind: Stream processor
Category: Messaging
Official docs: https://www.elastic.co/docs/reference/logstash/logstash-settings-file

Properties · 4 set by this component

property	type	values	required	kind default	this component
batchDelayMs · component property	integer	—	no	50	inherited
batchSize · component property	integer	—	no	125	inherited
checkpointIntervalSeconds	integer	—	no	—	inherited
deadLetterQueue · component property	boolean	—	no	false	inherited
exactlyOnce	boolean	—	no	false	▸ false
instances	integer	—	no	—	inherited
lateDataPolicy	enum	drop \| shift \| sideline	no	—	inherited
managed	boolean	—	no	false	▸ false
queueType · component property	enum	memory \| persisted	no	memory	inherited
stateBackend	enum	memory \| rocksdb \| external	no	memory	▸ memory
watermarkSeconds	integer	—	no	—	inherited
windowing	enum	none \| event-time \| processing-time	no	none	▸ none

Rules that apply · 1

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

Event-time windows without watermarkwarning

windowed-aggregation-without-watermark

Event-time windows need a watermark to know when a window is complete. Without one the processor either waits forever or closes windows early and silently drops late events.

— all of these hold:
— the node's `windowing` is "event-time"
— the node's `watermarkSeconds` has no value

Use it in a design

nodes:
  - { id: "logstash", component: "logstash" }

Other Stream processor products · 33

Realtime Compute for Apache Flinkalibaba-flinkalibabacloudstream-processor Amazon EventBridge Pipesaws-eventbridge-pipesawsstream-processor Amazon Data Firehoseaws-firehoseawsstream-processor Amazon Managed Service for Apache Flinkaws-managed-flinkawsstream-processor Amazon OpenSearch Ingestionaws-opensearch-ingestionawsstream-processor Azure Stream Analyticsazure-stream-analyticsazurestream-processor Cloudflare Logpushcloudflare-logpushcloudflarestream-processor Cloudflare Pipelinescloudflare-pipelinescloudflarestream-processor Arroyoarroyostream-processor Apache Beambeamstream-processor Bytewaxbytewaxstream-processor Drasidrasistream-processor Apache Flinkflinkstream-processor Kafka Streamskafka-streamsstream-processor ksqlDBksqldbstream-processor Materializematerializestream-processor Apache NiFinifistream-processor Norikranorikrastream-processor Redpanda Connectredpanda-connectstream-processor RisingWaverisingwavestream-processor Apache Samzasamzastream-processor Snowplowsnowplowstream-processor Spark Structured Streamingspark-streamingstream-processor Apache Stormstormstream-processor Generic stream processorstream-processorstream-processor Tremortremorstream-processor Google Cloud Dataflowgoogle-dataflowgcpstream-processor Manufacturing Data Enginegoogle-manufacturing-data-enginegcpstream-processor Activity Tracker Event Routingibm-activity-tracker-event-routingibmstream-processor IBM Cloud Logs Routingibm-logs-routingibmstream-processor IBM Cloud Metrics Routingibm-metrics-routingibmstream-processor OCI Connector Huboci-connector-hubocistream-processor OCI GoldenGate Stream Analyticsoci-goldengate-stream-analyticsocistream-processor

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Logstash: pipeline for ingest, transform and ship. logstash.yml defaults are queue.type memory
3# (so events in flight are lost on restart), pipeline.batch.size 125, pipeline.batch.delay 50 ms,
4# pipeline.workers equal to the host's CPU cores and dead_letter_queue.enable false
5# ("Logstash Reference, logstash.yml settings file").
6schemaVersion: "1"
7type: "component"
8id: "logstash"
9kind: "stream-processor"
10provider: "default"
11docs: "https://www.elastic.co/docs/reference/logstash/logstash-settings-file"
12defaults:
13  managed: false
14  windowing: "none"
15  exactlyOnce: false
16  stateBackend: "memory"
17properties:
18  queueType:
19    type: "enum"
20    values: ["memory", "persisted"]
21    default: "memory"
22  batchSize:
23    type: "integer"
24    default: 125
25  batchDelayMs:
26    type: "integer"
27    default: 50
28  deadLetterQueue:
29    type: "boolean"
30    default: false

The same page as markdown, for an agent: /catalogue/components/logstash.md