Logstash

Part of the Elastic Stack that handles collecting, and transporting log file records.

It is able to consolidate data from various sources and normalise them.

Process

Logstash operates by:

1. Processing inputs, which can come from reading a flat file, a TCP Socket, or directly from a syslog message.
2. Transforming and enriching log records, which can be done using filter plugins that are configured based on some predefined conditions.
3. Sending log records to Elasticsearch, or other destinations based on output plugins.