---
title: Logstash
description: Coralogix provides a seamless integration with Logstash, so you can send your logs from anywhere and parse them according to your needs.
url: https://coralogix.com/docs/integrations/files/logstash/
product: ingress
feature: Logs Ingress
feature_id: logs.ingress
feature_identifier: ingress/logs.ingress
last_updated: '2026-10-24'
---

# Logstash

Warning

**Security advisory**: On October 20, 2026, the private keys for 8 intermediate certificate authorities operated by eMudhra were reported compromised. This is an industry-wide issue, not specific to Coralogix. Pull the updated `coralogixrepo/logstash-coralogix-image:v7.17.2` image and restart. Force a re-pull if you already run this tag, since a cached image won't be replaced. Coralogix endpoints and internal services do not use eMudhra or emSign certificates, and we have not identified any impact to customer data.

See the [eMudhra security advisory](https://coralogix.com/blog/coralogix-security-advisory-emudhra-certificate-update/) for full upgrade guidance and breaking-change details.

If you have any questions or need help upgrading, our Support team is here to help. Reach out through in-app chat and mention "Security advisory eMudhra" and the required component.

Coralogix provides seamless integration with Logstash, so you can send your logs from anywhere and parse them according to your needs.

## Prerequisites

* Logstash [installed](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html)

## Best Practices

We **recommend** using the generic http output plugin with this integration, given its high level of configurability and metric support for monitoring output.

## Installation

**STEP 1**. Share the Ruby code snippet depicting the event structure as it flows through Logstash.

* \[Optional] Use this opportunity to set dynamic application and subsystem fields.

* The example below adopts a JSON structure and has these fields: application, subsystem and host.

```
filter {

  ruby {code => "

                event.set('[@metadata][application]', event.get('application'))

                event.set('[@metadata][subsystem]', event.get('subsystem'))

                event.set('[@metadata][event]', event.to_json)

                event.set('[@metadata][host]', event.get('host'))

                "}

}
```

* If you prefer that the fields application, subsystem and host remain static, replace the `event.get` with a plain string, as in the example below.

```
filter {

  ruby {code => "

                event.set('[@metadata][application]', MyApplicationName)

                event.set('[@metadata][subsystem]', MySubsystemName)

                event.set('[@metadata][event]', event.to_json)

                event.set('[@metadata][host]', event.get('host'))

                "}

}
```

**STEP 2**. Once the Event is ready, configure the output itself to send the logs.

* Input your [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md).

* Choose the <!-- -->https\://ingress./logs/v1/singles<!-- --> endpoint that corresponds to your Coralogix [domain](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain.md) using the domain selector at the top of the page.

```
output {

	http {

        url => "https://ingress.eu2.coralogix.com/logs/v1/singles"

        http_method => "post"

        headers => ["authorization", "Bearer <Coralogix Send-Your-Data API key>"]

        format => "json_batch"

        codec => "json"

        mapping => {

            "applicationName" => "%{[@metadata][application]}"

            "subsystemName" => "%{[@metadata][subsystem]}"

            "computerName" => "%{[@metadata][host]}"

            "text" => "%{[@metadata][event]}"

        }

        http_compression => true

        automatic_retries => 5

        retry_non_idempotent => true

        connect_timeout => 30

        keepalive => false

        }

}
```

## Additional resources

|                     |                                                                                       |
| ------------------- | ------------------------------------------------------------------------------------- |
| Coralogix Endpoints | [Coralogix Endpoints](https://coralogix.com/docs/integrations/coralogix-endpoints.md) |