Logstash: Output Plugins

Logstash Output Plugins with Most Common Output Types

csv

output {
  csv {
    fields => ["title", "user", "@timestamp"]
    path => "logs/output.csv"

    # exmpale of dynamic file name: "output-%{+YYYY-MM-dd}.csv"
  }
}

elasticsearch

output {
  elasticsearch {
    hosts => "localhost"
    index => "blogs"
    action => "index"
    document_type => "%{type}"
    document_id => "%{doc_id}"
    template => "./template.json"
  }
}

file

output {
  file {
    path => "logs/output.log"
    codec => "rubydebug"
  }
}

stdout

• recommended to debug

output {
  stdout {
    codec => "rubydebug"
  }
}

email

output {
  if "critical" in [message]
  {
    email {
      address => "smtp.gmail.com"
      domain => "smtp.gmail.com"
      port => 25
      username => "user@gmail.com"
      password => "pw"
      use_tls => true
      from => "no-reply@gmail.com"
      subject => "Critical Error"
      to => "developer@gmail.com"
      via => "smtp"
      body => "A critical error occured. %{message}"
    }
  }
}

s3

output {
  s3 {
    access_key_id => "aws_key"
    secret_access_key => "aws_access_key"
    region => "eu-west-1"
    bucket => "log_bucket"
    size_file => 1024
    time_file => 10
  }
}

tcp

output {
  tcp {
    host => "localhost"
    port => 5200
  }
}

udp

output {
  udp {
    host => "localhost"
    port => 5200
  }
}

• mongodb
• syslog