Alibaba Cloud Logstash supports over 100 default system plugins, including open source and proprietary plugins, that enhance data transmission, processing, and log debugging capabilities.
Alibaba Cloud Logstash supports only pre-installed default system plugins. Custom plugins are not supported. You can install or uninstall them as needed. Install or uninstall plugins. The resources of an Alibaba Cloud Logstash instance are for your use only. Do not use instance resources for illegal operations.
Alibaba Cloud Logstash supports the following plugins:
-
Custom plugins
Category
Name
Description
Introduction
input
logstash-input-maxcompute
Reads data from Alibaba Cloud MaxCompute.
logstash-input-oss
Reads data from Alibaba Cloud Object Storage Service (OSS).
logstash-input-sls
Reads logs from Alibaba Cloud Simple Log Service (SLS).
output
logstash-output-file_extend
Shows the output of a pipeline configuration directly in the console.
logstash-output-oss
Transfers data in batches to Alibaba Cloud OSS.
-
Open source plugins
Category
Name
Description
Introduction
input
logstash-input-azure_event_hubs
Consumes events from Azure Event Hubs.
logstash-input-beats
Receives events from the Elastic Beats framework.
logstash-input-dead_letter_queue
Reads events from the Logstash dead letter queue.
logstash-input-elasticsearch
Reads data from an Elasticsearch cluster.
logstash-input-exec
Runs a shell command periodically and captures the full output of the command as an event.
logstash-input-ganglia
Reads Ganglia packets from the network over User Datagram Protocol (UDP).
logstash-input-gelf
Reads GELF-formatted messages as events over the network.
logstash-input-generator
Generates random log events.
logstash-input-graphite
Reads metrics from the Graphite tool.
logstash-input-heartbeat
Generates heartbeat messages.
logstash-input-http
Receives single or multi-line events over HTTP or HTTPS.
logstash-input-http_poller
Calls an HTTP API, decodes the output into events, and sends the events.
logstash-input-imap
Reads emails from an IMAP server.
logstash-input-jdbc
Reads data from any database into Logstash through a Java Database Connectivity (JDBC) interface.
logstash-input-kafka
Reads events from a Kafka topic.
logstash-input-pipe
Streams events from a long-running pipe command.
logstash-input-rabbitmq
Reads events from a RabbitMQ queue.
logstash-input-redis
Reads events from a Redis instance.
logstash-input-s3
Streams events from files in an S3 bucket.
logstash-input-snmp
Polls network devices using Simple Network Management Protocol (SNMP) to obtain information about the current operational status of the devices.
logstash-input-snmptrap
Reads SNMP trap messages as events.
logstash-input-sqs
Reads events from a queue in Amazon Simple Queue Service (SQS).
logstash-input-stdin
Reads events from standard input.
logstash-input-syslog
Reads syslog messages as events over the network.
logstash-input-tcp
Reads events over a TCP socket.
logstash-input-twitter
Receives events from the Twitter Streaming API.
logstash-input-udp
Reads messages as events over the network using UDP.
logstash-input-unix
Reads events over a UNIX socket.
output
logstash-output-elasticsearch
Writes data to an Elasticsearch cluster.
logstash-output-kafka
Writes events to a Kafka topic.
logstash-output-lumberjack
Sends events using the lumberjack protocol.
logstash-output-nagios
Sends passive check results to Nagios through a Nagios command file.
logstash-output-pagerduty
Sends notifications based on pre-configured services and escalation policies.
logstash-output-pipe
Pipes events to the standard input of another program.
logstash-output-rabbitmq
Pushes events to a RabbitMQ exchange.
logstash-output-redis
Sends events to a Redis queue using the RPUSH command.
logstash-output-s3
Uploads Logstash events in batches to Amazon Simple Storage Service (Amazon S3).
logstash-output-sns
Sends events to Amazon Simple Notification Service, which is a managed pub/sub service.
logstash-output-sqs
Pushes events to an Amazon Web Services (AWS) SQS queue.
logstash-output-stdout
Prints events to the standard output of the shell command that is running Logstash.
logstash-output-tcp
Writes events over a TCP socket.
logstash-output-udp
Sends events over UDP.
logstash-output-webhdfs
Sends Logstash events to files in HDFS through the WebHDFS REST API.
logstash-output-cloudwatch
Aggregates and sends metric data to AWS CloudWatch.
logstash-output-csv
Writes events to disk in comma-separated values (CSV) or other delimited formats. This output shares the same options as the file output. It internally uses the Ruby CSV library.
logstash-output-elastic_app_search
Sends events to the Elastic App Search solution.
logstash-output-email
Sends an email upon receiving an output. Use conditions to include or exclude the execution of the email output.
logstash-output-file
Writes events to a file on disk. You can use fields from the event as part of the filename or path.
logstash-output-graphite
Reads metric data from logs and sends it to the Graphite tool. Graphite is an open source tool for storing and plotting metrics.
logstash-output-http
Sends events to a generic HTTP or HTTPS endpoint.
filter
logstash-filter-aggregate
Aggregates information from multiple events (usually log records) under a single task and pushes the aggregated information to the final task event.
logstash-filter-anonymize
Replaces field values with a consistent hash to anonymize fields.
logstash-filter-cidr
Checks IP addresses in an event against a list of network blocks.
logstash-filter-prune
Prunes event data based on a blacklist or whitelist of fields.
logstash-filter-clone
Checks for duplicate events. A clone is created for each type in the clone list.
logstash-filter-csv
Parses an event field that contains CSV data and stores it as separate fields. You can also specify the names of the fields. This filter can also parse data with any separator, not just commas.
logstash-filter-date
Parses a date from a field and then uses that date or timestamp as the Logstash timestamp for the event.
logstash-filter-de_dot
Renames fields by replacing dot (.) characters with another separator. In practice, this filter is expensive. It must copy the source field content to a new destination field whose name no longer contains dots, and then remove the corresponding source field.
logstash-filter-dissect
The Dissect filter is a split operation.
logstash-filter-dns
Performs a DNS lookup (A record or CNAME record lookup, or a reverse lookup for a PTR record) on each or specified record under the reverse array.
logstash-filter-drop
Deletes all events that satisfy this filter.
logstash-filter-elasticsearch
Searches for past log events in Elasticsearch and copies some of their fields to the current event.
logstash-filter-fingerprint
Creates a consistent hash (fingerprint) of one or more fields and stores the result in a new field.
logstash-filter-geoip
Adds geographic location information about an IP address based on data from the Maxmind GeoLite2 database.
logstash-filter-grok
Parses and structures any unstructured text.
logstash-filter-http
Integrates external web services or multiple REST APIs.
logstash-filter-jdbc_static
Enriches events with data pre-loaded from a remote database.
logstash-filter-jdbc_streaming
Executes an SQL query and stores the result set in a destination field. Caches the results in a local least recently used (LRU) cache with an expiration period.
logstash-filter-json
A JSON parsing filter that expands an existing field containing JSON into an actual data structure within the Logstash event.
logstash-filter-kv
Automatically parses various foo=bar messages or specific event fields.
logstash-filter-memcached
Integrates external data into Memcached.
logstash-filter-metrics
Aggregates metrics.
logstash-filter-mutate
Performs transformations on fields. Rename, delete, replace, and modify fields in your events.
logstash-filter-ruby
Executes Ruby code. This filter accepts either inline Ruby code or a file. The two options are mutually exclusive and work in slightly different ways.
logstash-filter-sleep
Sleeps for a specified duration. Logstash stops during the sleep period. This helps with rate limiting.
logstash-filter-split
Clones an event by splitting a field in the event and embedding each resulting value into a clone of the original event. The field being split can be a string or an array of strings.
logstash-filter-syslog_pri
Parses the PRI field at the beginning of a Syslog (RFC3164) message. If no priority is set, it defaults to 13, as defined in the RFC.
logstash-filter-throttle
Limits the number of events.
logstash-filter-translate
A general search-and-replace tool that determines replacement values based on a configured hash or file.
logstash-filter-truncate
Truncates fields that exceed a certain length.
logstash-filter-urldecode
Decodes URL-encoded fields.
logstash-filter-useragent
Parses user agent strings into structured data based on BrowserScope data.
logstash-filter-xml
An XML filter. Expands a field containing XML into an actual data structure.
codec
logstash-codec-cef
Uses a Logstash codec to process ArcSight Common Event Format (CEF) data, according to "Implementing ArcSight Common Event Format," Revision 20 (June 5, 2013).
logstash-codec-collectd
Reads events from the collectd binary protocol over the network using UDP.
logstash-codec-dots
This codec generates a dot (.) to represent each event it processes.
logstash-codec-edn
Reads and produces data in EDN format.
logstash-codec-edn_lines
Reads and produces newline-separated data in EDN format.
logstash-codec-es_bulk
Decodes the Elasticsearch bulk format into separate events and decodes metadata into the [@metadata](/metadata) field.
logstash-codec-fluent
Processes the fluentd msgpack format.
logstash-codec-graphite
Encodes and decodes lines in Graphite format.
logstash-codec-json
Decodes (from an input) and encodes (to an output) full JSON messages.
logstash-codec-json_lines
Decodes a newline-separated JSON stream.
logstash-codec-line
Reads line-oriented text data.
logstash-codec-msgpack
Reads and produces MessagePack-encoded content.
logstash-codec-multiline
Merges multi-line messages into a single event.
logstash-codec-netflow
Decodes Netflow v5, v9, and v10 (IPFIX) data.
logstash-codec-plain
Processes plaintext with no delimiters between events.
logstash-codec-rubydebug
Outputs Logstash event data using the Ruby Awesome Print library.