Input plugins
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Generally available
An input plugin enables a specific source of events to be read by Logstash.
The following input plugins are available below. For a list of Elastic supported plugins, please consult the Support Matrix.
| Plugin | Description | Github repository |
|---|---|---|
| azure_event_hubs | Receives events from Azure Event Hubs | azure_event_hubs |
| beats | Receives events from the Elastic Beats framework | logstash-input-beats |
| cloudwatch | Pulls events from the Amazon Web Services CloudWatch API | logstash-input-cloudwatch |
| couchdb_changes | Streams events from CouchDB's _changes URI |
logstash-input-couchdb_changes |
| dead_letter_queue | read events from Logstash's dead letter queue | logstash-input-dead_letter_queue |
| elastic_agent | Receives events from the Elastic Agent framework | logstash-input-beats (shared) |
| elastic_serverless_forwarder | Accepts events from Elastic Serverless Forwarder | logstash-input-elastic_serverless_forwarder |
| elasticsearch | Reads query results from an Elasticsearch cluster | logstash-input-elasticsearch |
| exec | Captures the output of a shell command as an event | logstash-input-exec |
| file | Streams events from files | logstash-input-file |
| ganglia | Reads Ganglia packets over UDP | logstash-input-ganglia |
| gelf | Reads GELF-format messages from Graylog2 as events | logstash-input-gelf |
| generator | Generates random log events for test purposes | logstash-input-generator |
| github | Reads events from a GitHub webhook | logstash-input-github |
| google_cloud_storage | Extract events from files in a Google Cloud Storage bucket | logstash-input-google_cloud_storage |
| google_pubsub | Consume events from a Google Cloud PubSub service | logstash-input-google_pubsub |
| graphite | Reads metrics from the graphite tool |
logstash-input-graphite |
| heartbeat | Generates heartbeat events for testing | logstash-input-heartbeat |
| http | Receives events over HTTP or HTTPS | logstash-input-http |
| http_poller | Decodes the output of an HTTP API into events | logstash-input-http_poller |
| imap | Reads mail from an IMAP server | logstash-input-imap |
| irc | Reads events from an IRC server | logstash-input-irc |
| java_generator | Generates synthetic log events | core plugin |
| java_stdin | Reads events from standard input | core plugin |
| jdbc | Creates events from JDBC data | logstash-integration-jdbc |
| jms | Reads events from a Jms Broker | logstash-input-jms |
| jmx | Retrieves metrics from remote Java applications over JMX | logstash-input-jmx |
| kafka | Reads events from a Kafka topic | logstash-integration-kafka |
| kinesis | Receives events through an AWS Kinesis stream | logstash-input-kinesis |
| log4j | Reads events over a TCP socket from a Log4j SocketAppender object |
logstash-input-log4j |
| logstash | Reads from Logstash output of another Logstash instance | logstash-integration-logstash |
| lumberjack | Receives events using the Lumberjack protocl | logstash-input-lumberjack |
| meetup | Captures the output of command line tools as an event | logstash-input-meetup |
| pipe | Streams events from a long-running command pipe | logstash-input-pipe |
| puppet_facter | Receives facts from a Puppet server | logstash-input-puppet_facter |
| rabbitmq | Pulls events from a RabbitMQ exchange | logstash-integration-rabbitmq |
| redis | Reads events from a Redis instance | logstash-input-redis |
| relp | Receives RELP events over a TCP socket | logstash-input-relp |
| rss | Captures the output of command line tools as an event | logstash-input-rss |
| s3 | Streams events from files in a S3 bucket | logstash-input-s3 |
| s3-sns-sqs | Reads logs from AWS S3 buckets using sqs | logstash-input-s3-sns-sqs |
| salesforce | Creates events based on a Salesforce SOQL query | logstash-input-salesforce |
| snmp | Polls network devices using Simple Network Management Protocol (SNMP) | logstash-integration-snmp |
| snmptrap | Creates events based on SNMP trap messages | logstash-integration-snmp |
| sqlite | Creates events based on rows in an SQLite database | logstash-input-sqlite |
| sqs | Pulls events from an Amazon Web Services Simple Queue Service queue | logstash-input-sqs |
| stdin | Reads events from standard input | logstash-input-stdin |
| stomp | Creates events received with the STOMP protocol | logstash-input-stomp |
| syslog | Reads syslog messages as events | logstash-input-syslog |
| tcp | Reads events from a TCP socket | logstash-input-tcp |
| Reads events from the Twitter Streaming API | logstash-input-twitter | |
| udp | Reads events over UDP | logstash-input-udp |
| unix | Reads events over a UNIX socket | logstash-input-unix |
| varnishlog | Reads from the varnish cache shared memory log |
logstash-input-varnishlog |
| websocket | Reads events from a websocket | logstash-input-websocket |
| wmi | Creates events based on the results of a WMI query | logstash-input-wmi |
| xmpp | Receives events over the XMPP/Jabber protocol | logstash-input-xmpp |