Logstash is a server app that ingests and parses log data. We recommend using it for shipping to Logz.io only when you have an existing Logstash configuration.
For most other cases, we recommend using Filebeat.
Ship with Logstash over SSL
Before you begin, you’ll need: JDK, Logstash
Download the Logz.io public certificate
For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder.
sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /usr/share/logstash/keys/TrustExternalCARoot.crt
Add Logz.io to your configuration file
Add these code blocks to the end of your existing Logstash configuration file.
Make sure the mutate
block is the last item in the filters
block.
Replace <<LOG-SHIPPING-TOKEN>>
with the token of the account you want to ship to.
Replace <<LISTENER-HOST>>
with your region’s listener host (for example, listener.logz.io
). For more information on finding your account’s region, see Account region.
filter {
# ...
# ...
mutate {
add_field => { "token" => "<<LOG-SHIPPING-TOKEN>>" }
}
}
output {
lumberjack {
hosts => ["<<LISTENER-HOST>>"]
port => 5006
ssl_certificate => "/usr/share/logstash/keys/TrustExternalCARoot.crt"
codec => "json_lines"
}
}
Start Logstash
Start or restart Logstash for the changes to take effect.
Check Logz.io for your logs
Give your logs some time to get from your system to ours, and then open Kibana.
If you still don’t see your logs, see log shipping troubleshooting.
Ship with Logstash over TCP
Before you begin, you’ll need: JDK, Logstash
Add Logz.io to your configuration file
Add these code blocks to the end of your existing Logstash configuration file.
Make sure the mutate
block is the last item in the filters
block.
Replace <<LOG-SHIPPING-TOKEN>>
with the token of the account you want to ship to.
Replace <<LISTENER-HOST>>
with your region’s listener host (for example, listener.logz.io
). For more information on finding your account’s region, see Account region.
filter {
# ...
# ...
mutate {
add_field => { "token" => "<<LOG-SHIPPING-TOKEN>>" }
}
}
output {
tcp {
host => "<<LISTENER-HOST>>"
port => 5050
codec => json_lines
}
}
Start Logstash
Start or restart Logstash for the changes to take effect.
Check Logz.io for your logs
Give your logs some time to get from your system to ours, and then open Kibana.
If you still don’t see your logs, see log shipping troubleshooting.