Basic Operations

Basic

Stdin, Stdout

You may create a conf file like:

input {
    stdin {

    }
}

output {
    stdout {
        codec => rubydebug
    }
}

Then run:

/usr/share/logstash/bin/logstash -f test.conf 

Stdin on JSON

We can use codec json:

input {
    stdin {
        codec => json
    }
}

output {
    stdout {
        codec => rubydebug
    }
}

Then run

/usr/share/logstash/bin/logstash -f jsontest.conf

We can pass multiple JSON objects as a list

Non-JSON object will be stored in the "message" field

Output to a file

Our config could be:

input {
    stdin {
        codec => json
    }
}

output {
    stdout {
        codec => rubydebug
    }
    file {
        path => "/tmp/out.txt"
    }
}

Then run:

/usr/share/logstash/bin/logstash -f file_out_test.conf

HTTP Input

Conf:

input {
    stdin {
        codec => json
    }
    http {
        host => "127.0.0.1"
        port => 8080
    }
}

output {
    stdout {
        codec => rubydebug
    }
    file {
        path => "/tmp/http_out.txt"
    }
}

Run:

/usr/share/logstash/bin/logstash -f http_input_test.conf

Send an event to Logstash using CURL

Output of Logstash

Filtering

Conf:

input {
    stdin {
        codec => json
    }
    http {
        host => "127.0.0.1"
        port => 8080
    }
}

filter {
    mutate {
        convert => { "quantity" => "integer" }
    }
}

output {
    stdout {
        codec => rubydebug
    }
    file {
        path => "/tmp/filter_out.txt"
    }
}

Use CURL to send HTTP request with JSON (contain a string "100") to Logstash

Thanks to mutate-convert, 100 is convert to integer instead of string

More mutate:

Mutate filter plugin | Logstash Reference [7.16] | ElasticElastic

• add_field

• remove_field

• add_tag

• remove_tag