Logstash Integration

Overview

Get metrics from Logstash service in real time to:

• Visualize and monitor Logstash states.
• Be notified about Logstash events.

Setup

The Logstash check is NOT included in the Datadog Agent package.

Installation

To install the Logstash check on your host:

1. Download the Datadog Agent.
2. Download the check.py file for Logstash.
3. Place it in the Agent's checks.d directory.
4. Rename it to logstash.py.

Configuration

To configure the Logstash check:

1. Create a logstash.d/ folder in the conf.d/ folder at the root of your Agent's directory.
2. Create a conf.yaml file in the logstash.d/ folder previously created.
3. Consult the sample logstash.yaml file and copy its content in the conf.yaml file.
4. Edit the conf.yaml to start collecting your metrics or logs
5. Restart the Agent.

Metric Collection

• Add this configuration setup to your conf.yaml file to start gathering your Logstash metrics:

init_config:

instances:
  #   The URL where Logstash provides its monitoring API. This will be used to fetch various runtime metrics about Logstash.
  #
  - url: http://localhost:9600

Configure it to point to your server and port.

See the sample conf.yaml for all available configuration options.

• Restart the Agent to begin sending Logstash metrics to Datadog.

Log Collection

Datadog has an ouput plugin for Logstash that takes care of sending your logs to your Datadog platform.

To install this plugin run the following command:

• logstash-plugin install logstash-output-datadog_logs

Then configure the datadog_logs plugin with your Datadog API key:

output {
    datadog_logs {
        api_key => "<DATADOG_API_KEY>"
    }
}

Add metadata to your logs

In order to get the best use out of your logs in Datadog, it is important to have the proper metadata associated with your logs (including hostname and source). By default, the hostname and timestamp should be properly remapped thanks to our default remapping for reserved attributes. To make sure the service is correctly remapped, add its attribute value to the Service remapping list.

Source

Setup a Logstash filter to set the source (Datadog integration name) on your logs.

filter {
  mutate {
    add_field => {
 "ddsource" => "<MY_SOURCE_VALUE>"
       }
    }
 }

This triggers the integration automatic setup in Datadog.

Custom tags

Host tags are automatically set on your logs if there is a matching hostname in your infrastructure list. Use the ddtags attribute to add custom tags to your logs:

filter {
  mutate {
    add_field => {
        "ddtags" => "env:test,<KEY:VALUE>"
       }
    }
 }

Validation

Run the Agent's status subcommand and look for logstash under the Checks section.

Compatibility

The Logstash check is compatible with Logstash 5.6 and possible earlier versions. Currently it does not support the new pipelines metrics in Logstash 6.0 yet.

Data Collected

Metrics

See metadata.csv for a list of metrics provided by this check.

Events

The Logstash check does not include any events at this time.

Service checks

logstash.can_connect:

Returns Critical if the Agent cannot connect to Logstash to collect metrics, returns OK otherwise.

Troubleshooting

Agent cannot connect

    logstash
    -------
      - instance #0 [ERROR]: "('Connection aborted.', error(111, 'Connection refused'))"
      - Collected 0 metrics, 0 events & 1 service check

Check that the url in conf.yaml is correct.

If you need further help, contact Datadog support.