{"_id":"5a8fae0468264c001f20cc44","category":{"_id":"5a8fae0368264c001f20cc05","version":"5a8fae0268264c001f20cc00","project":"5633ebff7e9e880d00af1a53","__v":0,"sync":{"url":"","isSync":false},"reference":false,"createdAt":"2016-01-04T21:11:27.469Z","from_sync":false,"order":6,"slug":"dashboards","title":"Common Tools"},"parentDoc":null,"user":"5637d336aa96490d00a64f81","project":"5633ebff7e9e880d00af1a53","version":{"_id":"5a8fae0268264c001f20cc00","project":"5633ebff7e9e880d00af1a53","__v":2,"createdAt":"2018-02-23T06:00:34.961Z","releaseDate":"2018-02-23T06:00:34.961Z","categories":["5a8fae0268264c001f20cc01","5a8fae0268264c001f20cc02","5a8fae0368264c001f20cc03","5a8fae0368264c001f20cc04","5a8fae0368264c001f20cc05","5a8fae0368264c001f20cc06","5a8fae0368264c001f20cc07","5a8fae0368264c001f20cc08","5a8fae0368264c001f20cc09","5abaa7eb72d6dc0028a07bf3"],"is_deprecated":false,"is_hidden":false,"is_beta":false,"is_stable":true,"codename":"","version_clean":"2.0.0","version":"2.0"},"__v":0,"updates":[],"next":{"pages":[],"description":""},"createdAt":"2016-01-27T02:26:47.237Z","link_external":false,"link_url":"","githubsync":"","sync_unique":"","hidden":false,"api":{"results":{"codes":[]},"settings":"","auth":"required","params":[],"url":""},"isReference":false,"order":2,"body":"Logstash is a data processing tool for ingesting logs into Elasticsearch. It plays a prominent role in the Elastic suite, and a common question is whether Bonsai offers support for it.\n\nThe answer is a qualified \"yes.\" Logstash is a server-side tool, meaning it runs outside of Bonsai's infrastructure and Bonsai is not involved in its configuration or management. But as a host, Bonsai is not opinionated about _where_ your cluster's data comes from. So if you have Logstash running on your servers, you can configure an output to your Bonsai cluster, and it will work.\n\nConnecting your Logstash instance to a Bonsai cluster is as easy as adding an output to the Logstash configuration file like so:\n[block:code]\n{\n  \"codes\": [\n    {\n      \"code\": \"output {\\n    elasticsearch {\\n        # https://randomuser:randompass:::at:::something-12345.us-east-1.bonsai.io\\n        # would be entered as:\\n        hosts     => [\\\"something-12345.us-east-1.bonsai.io:443\\\"]\\n        user      => \\\"randomuser\\\"\\n        password  => \\\"randompass\\\"\\n        ssl       => true\\n        index     => \\\"<whatever your logstash index will be named>\\\"\\n    }\\n}\",\n      \"language\": \"text\"\n    }\n  ]\n}\n[/block]\n\n[block:callout]\n{\n  \"type\": \"info\",\n  \"title\": \"Autocreation and Bonsai\",\n  \"body\": \"If an application sends data to an index which does not exist, Elasticsearch will create that index and assume its mappings from the data in the payload. This feature is called autocreation, and it is supported in a _limited_ capacity on Bonsai. Certain base names can be used for autocreation. Those base names are:\\n\\n* .kibana\\n* events\\n* filebeat\\n* kibana-int\\n* logstash\\n* requests\\n\\nThis means your logstash index *must* start with one of these index names, or it will not be automatically created.\"\n}\n[/block]\nWe have made a number of tests and verified that we are fully compatible with Logstash, as of version 1.5+. Older versions of Logstash don't have support for SSL/TLS or HTTP Basic Auth; these older versions _can_ work with Bonsai, but only without the benefits of encryption or authentication.\n\nIf you have any issues getting Logstash to pass data along to Bonsai, [check the documentation](https://www.elastic.co/guide/en/logstash/current/configuration.html) to make sure it's set up correctly. If that doesn't help, feel free to reach out to us at [support@bonsai.io ](mailto:support@bonsai.io) and we'll do our best to get you pointed in the right direction.","excerpt":"","slug":"using-logstash-with-bonsai","type":"basic","title":"Using Logstash with Bonsai"}

Using Logstash with Bonsai


Logstash is a data processing tool for ingesting logs into Elasticsearch. It plays a prominent role in the Elastic suite, and a common question is whether Bonsai offers support for it. The answer is a qualified "yes." Logstash is a server-side tool, meaning it runs outside of Bonsai's infrastructure and Bonsai is not involved in its configuration or management. But as a host, Bonsai is not opinionated about _where_ your cluster's data comes from. So if you have Logstash running on your servers, you can configure an output to your Bonsai cluster, and it will work. Connecting your Logstash instance to a Bonsai cluster is as easy as adding an output to the Logstash configuration file like so: [block:code] { "codes": [ { "code": "output {\n elasticsearch {\n # https://randomuser:randompass@something-12345.us-east-1.bonsai.io\n # would be entered as:\n hosts => [\"something-12345.us-east-1.bonsai.io:443\"]\n user => \"randomuser\"\n password => \"randompass\"\n ssl => true\n index => \"<whatever your logstash index will be named>\"\n }\n}", "language": "text" } ] } [/block] [block:callout] { "type": "info", "title": "Autocreation and Bonsai", "body": "If an application sends data to an index which does not exist, Elasticsearch will create that index and assume its mappings from the data in the payload. This feature is called autocreation, and it is supported in a _limited_ capacity on Bonsai. Certain base names can be used for autocreation. Those base names are:\n\n* .kibana\n* events\n* filebeat\n* kibana-int\n* logstash\n* requests\n\nThis means your logstash index *must* start with one of these index names, or it will not be automatically created." } [/block] We have made a number of tests and verified that we are fully compatible with Logstash, as of version 1.5+. Older versions of Logstash don't have support for SSL/TLS or HTTP Basic Auth; these older versions _can_ work with Bonsai, but only without the benefits of encryption or authentication. If you have any issues getting Logstash to pass data along to Bonsai, [check the documentation](https://www.elastic.co/guide/en/logstash/current/configuration.html) to make sure it's set up correctly. If that doesn't help, feel free to reach out to us at [support@bonsai.io ](mailto:support@bonsai.io) and we'll do our best to get you pointed in the right direction.