After you purchase an Alibaba Cloud Logstash cluster, the built-in plug-ins of the cluster are displayed on the Plug-ins page of the cluster in the Elasticsearch console. You can install or remove the plug-ins based on your business requirements. This topic describes how to install and remove a built-in plug-in.


An Alibaba Cloud Logstash cluster is created. For more information, see Step 1: Create a Logstash cluster.


  • Alibaba Cloud Logstash does not support the logstash-input-file plug-in. If you want to use Logstash to collect data from files on your on-premises machine, you can use the logstash-input-beats plug-in to use Filebeat as the Logstash input, and use a port that ranges from 8000 to 9000.
  • After you install or remove a built-in plug-in for a Logstash cluster, the system restarts the cluster. After you remove a built-in plug-in, this plug-in is no longer displayed on the Plug-ins page. We recommend that you install or remove a built-in plug-in during off-peak hours.


  1. Log on to the Elasticsearch console.
  2. Navigate to the desired cluster.
    1. In the top navigation bar, select the region where the cluster resides.
    2. In the left-side navigation pane, click Logstash Clusters. On the Logstash Clusters page, find the cluster and click its ID.
  3. In the left-side navigation pane of the page that appears, click Plug-ins.
  4. On the Built-in Plug-ins tab, find the plug-in that you want to install or remove, and click Install or Remove in the Actions column.
  5. Read the message that appears and click OK.
    Then, the system restarts the cluster. You can view the restart progress in the Tasks dialog box. For more information, see View the progress of a cluster task. After the cluster is restarted, the plug-in is installed or removed.