Filter plugins
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Generally available
A filter plugin performs intermediary processing on an event. Filters are often applied conditionally depending on the characteristics of the event.
The following filter plugins are available below. For a list of Elastic supported plugins, please consult the Support Matrix.
| Plugin | Description | Github repository |
|---|---|---|
| age | Calculates the age of an event by subtracting the event timestamp from the current timestamp | logstash-filter-age |
| aggregate | Aggregates information from several events originating with a single task | logstash-filter-aggregate |
| alter | Performs general alterations to fields that the mutate filter does not handle |
logstash-filter-alter |
| bytes | Parses string representations of computer storage sizes, such as "123 MB" or "5.6gb", into their numeric value in bytes | logstash-filter-bytes |
| cidr | Checks IP addresses against a list of network blocks | logstash-filter-cidr |
| cipher | Applies or removes a cipher to an event | logstash-filter-cipher |
| clone | Duplicates events | logstash-filter-clone |
| csv | Parses comma-separated value data into individual fields | logstash-filter-csv |
| date | Parses dates from fields to use as the Logstash timestamp for an event | logstash-filter-date |
| de_dot | Computationally expensive filter that removes dots from a field name | logstash-filter-de_dot |
| dissect | Extracts unstructured event data into fields using delimiters | logstash-filter-dissect |
| dns | Performs a standard or reverse DNS lookup | logstash-filter-dns |
| drop | Drops all events | logstash-filter-drop |
| elapsed | Calculates the elapsed time between a pair of events | logstash-filter-elapsed |
| elastic_integration | Provides additional Logstash processing on data from Elastic integrations | logstash-filter-elastic_integration |
| elasticsearch | Copies fields from previous log events in Elasticsearch to current events | logstash-filter-elasticsearch |
| environment | Stores environment variables as metadata sub-fields | logstash-filter-environment |
| extractnumbers | Extracts numbers from a string | logstash-filter-extractnumbers |
| fingerprint | Fingerprints fields by replacing values with a consistent hash | logstash-filter-fingerprint |
| geoip | Adds geographical information about an IP address | logstash-filter-geoip |
| grok | Parses unstructured event data into fields | logstash-filter-grok |
| http | Provides integration with external web services/REST APIs | logstash-filter-http |
| i18n | Removes special characters from a field | logstash-filter-i18n |
| java_uuid | Generates a UUID and adds it to each processed event | core plugin |
| jdbc_streaming | Enrich events with your database data | logstash-integration-jdbc |
| json | Parses JSON events | logstash-filter-json |
| json_encode | Serializes a field to JSON | logstash-filter-json_encode |
| kv | Parses key-value pairs | logstash-filter-kv |
| memcached | Provides integration with external data in Memcached | logstash-filter-memcached |
| metricize | Takes complex events containing a number of metrics and splits these up into multiple events, each holding a single metric | logstash-filter-metricize |
| metrics | Aggregates metrics | logstash-filter-metrics |
| mutate | Performs mutations on fields | logstash-filter-mutate |
| prune | Prunes event data based on a list of fields to blacklist or whitelist | logstash-filter-prune |
| range | Checks that specified fields stay within given size or length limits | logstash-filter-range |
| ruby | Executes arbitrary Ruby code | logstash-filter-ruby |
| sleep | Sleeps for a specified time span | logstash-filter-sleep |
| split | Splits multi-line messages, strings, or arrays into distinct events | logstash-filter-split |
| syslog_pri | Parses the PRI (priority) field of a syslog message |
logstash-filter-syslog_pri |
| threats_classifier | Enriches security logs with information about the attacker’s intent | logstash-filter-threats_classifier |
| throttle | Throttles the number of events | logstash-filter-throttle |
| tld | Replaces the contents of the default message field with whatever you specify in the configuration | logstash-filter-tld |
| translate | Replaces field contents based on a hash or YAML file | logstash-filter-translate |
| truncate | Truncates fields longer than a given length | logstash-filter-truncate |
| urldecode | Decodes URL-encoded fields | logstash-filter-urldecode |
| useragent | Parses user agent strings into fields | logstash-filter-useragent |
| uuid | Adds a UUID to events | logstash-filter-uuid |
| wurfl_device_detection | Enriches logs with device information such as brand, model, OS | logstash-filter-wurfl_device_detection |
| xml | Parses XML into fields | logstash-filter-xml |