I'm new to Logstash, and I'm trying to understand how inputs, filters and outputs work together. I get that there's a variety of inputs, filters and outputs, but what I don't get is how Logstash works with messages internally.

Say I configure a syslog input, and I'd like syslog events to be shipped to log index as GELF. There's a syslog input I can use, and there's a GELF output I can use. However, is it my responsibility (using filters) to populate the correct GELF field based on values from the syslog event?

Should I look at events (from input filters) as an entity with named fields (sort of a key:value array), and then use filters to make sure that outputs can get hold of the right data?


As Jordan Sissel said, think of it as a pipe on steroids, between input and output you can do what you want with the events, you can match parts of the message to field names using grok or you can use mutate to remove fields, regex style text replacement, add or remove tags. Once you have your data formatted how you want you can then send it to your output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.