Logstash

Logstash is often used when logs need filtering, enrichment, parsing, or routing before they reach storage. Parseable can receive the final JSON events from a Logstash pipeline over HTTP, so you can keep the filters you already use and only change the output destination.

Prerequisites

You need a running Logstash instance, a Parseable ingest endpoint, an API key, and a dataset name. The examples below use logstash-logs as the dataset.

Configure Logstash

Create or update a Logstash pipeline. This example receives Beats events, adds a small marker field, and sends batches to Parseable.

input {
  beats {
    port => 5044
  }
}

filter {
  mutate {
    add_field => { "source_agent" => "logstash" }
  }
}

output {
  http {
    url => "http://<parseable-ingestor-endpoint>:8000/api/v1/ingest"
    http_method => "post"
    format => "json_batch"
    content_type => "application/json"
    headers => {
      "X-API-Key" => "<parseable-api-key>"
      "X-P-Stream" => "logstash-logs"
    }
  }
}

If Logstash is already reading from files, Kafka, syslog, or another input, keep that input block and update only the output block.

Verify Logs

Restart Logstash after updating the pipeline, then send a test event through the input. In Parseable, open logstash-logs and confirm that events are arriving with the fields produced by your filters.

If events do not show up, check the Logstash pipeline logs first. A 401 or 403 response usually means the API key cannot write to the dataset. A 400 response usually means the event body or required headers are not reaching Parseable in the expected shape.