Read all reviews
We investigated (and use) Logstash as apart of our ELK (Elasticsearch, Logstash and Kibana) stack. We input data from websites that post …
My primary use case for Logstash is ingesting log files into a local Elasticsearch&Kibana Docker container so that I can easily search …
We were introduced to Logstash via the ELK stack. Our application generates many data points, and one of many patterns we had seen was to …
Leaving a video review helps other professionals like you evaluate products. Be the first one in your network to record a review of Logstash, and make your voice heard!
Entry-level set up fee?
- No setup fee
- Free Trial
- Free/Freemium Version
- Premium Consulting / Integration Services
Would you like us to let the vendor know that you want pricing?
1 person want pricing too
Companies can't remove reviews or game the system. Here's why
- Modern: most Admin, Server and/or DevtyOps-Centric software worth it's salt will have the ability to configure it's services and features from a small webpage and REST API. Logstash is no exception
- Speed: Logstash configuration is just a reload away. While you CAN use the gui (see point above), editing the configuration files directly is also a great option. Our configuration files are hosted on an internal Repository, that once we make a change, we and track them as we do a reload, and those changes are reflected in Logstash almost immediately (dependent on the Data Source's speed and flow of Data)
- Configuration: Logstash is very simple to configure, and fulfills our desire to keep configuration files in a plantext format.
- OpenSource friendly: Logstash is opensource, and built with open source tools
- Memory: Logstash is a HOG, if you are deploying it on commodity (i.e. cheap and old) hardware: You will need at least 2GB, just for Logstash. So don't expect to run your entire ELK stack on one AMD Athlon machine.
- Overlap: Logstash fills in an area of the ELK stack that makes the most sense: as a log file transformer / shipper. However, if you start breaking that stack, with the addition of other components- you start seeing where features of Logstash may be implemented or solved in the additional components much easier (or better, or to a higher degree of resolution)
- More Overlap: Since my team employs Syslog-ng extensively- Logstash can sometimes get in the way (and this may be a problem for DevOps stacks overall): You can configure Syslog to record certain information from a source, filter that data, and even export that data in a particular format. Logstash will pick that data up, and then parse it. However, if you don't keep your Syslog-ng configuration files, and your Logstash configuration files in sync, your results will not be what you expected, and this will translate into (sometimes) hours/days of work, hunting down a line item in a configuration file.
- Plugin ecosystem allows modular extensions.
- Tight integration into the Elastic.com products of Beats and Elasticsearch, so minimal setup is required when using those tools.
- Filter plugins are powerful for extracting and enriching input data.
- Since it's a Java product, JVM tuning must be done for handling high-load.
- The persistent queue feature is nice, but I feel like most companies would want to use Kafka as a general storage location for persistent messages for all consumers to use. Using some pipeline of "Kafka input -> filter plugins -> Kafka output" seems like a good solution for data enrichment without needing to maintain a custom Kafka consumer to accomplish a similar feature.
- I would like to see more documentation around creating a distributed Logstash cluster because I imagine for high ingestion use cases, that would be necessary.
- Logstash design is definitely perfect for the use case of ELK. Logstash has "drivers" using which it can inject from virtually any source. This takes the headache from source to implement those "drivers" to store data to ES.
- Logstash is fast, very fast. As per my observance, you don't need more than 1 or 2 servers for even big size projects.
- Data in different shape, size, and formats? No worries, Logstash can handle it. It lets you write simple rules to programmatically take decisions real-time on data.
- You can change your data on the fly! This is the CORE power of Logstash. The concept is similar to Kafka streams, the difference being the source and destination are application and ES respectively.
- Logstash is all command line, and it can become overwhelming for new developers. If it has any sort of UI, then I don't know about it.
- Documentation could have been better. But this is a work in progress, and with time I am sure community will help with documentation.
- Community support! Being a relatively new tool, the adoption is still mature, and finding answers can be challenging sometimes.