--- title: Deprecation of coralogix-hosted Logstash for legacy Filebeat ingestion description: Coralogix-hosted Logstash for legacy Filebeat ingestion retires by domain in 2026. Migrate to OpenTelemetry or run your own Logstash. url: https://coralogix.com/docs/user-guides/latest-updates/deprecations/logstash/ product: ingress feature: Logs Ingress feature_id: logs.ingress feature_identifier: ingress/logs.ingress last_updated: '2026-11-02' --- # Deprecation of coralogix-hosted Logstash for legacy Filebeat ingestion **Published:** February 16, 2026 **Effective:** June 30, 2026: extended to September 30, 2026 for the `eu1.coralogix.com` and `us1.coralogix.com` domains. ## End-of-life notice To improve platform reliability, simplify maintenance, and accelerate support for modern telemetry pipelines, Coralogix will retire the Coralogix-hosted [Logstash](https://coralogix.com/docs/integrations/files/logstash.md) service that supports the legacy [Filebeat-based ingestion flow](https://coralogix.com/docs/integrations/files/beats-filebeat.md). Action is required to avoid a loss of log ingestion after the effective date. End-of-life date depends on your domain The effective date differs by Coralogix domain: | Coralogix domain | End-of-life date | | ---------------------------------------- | ------------------ | | `eu1.coralogix.com`, `us1.coralogix.com` | September 30, 2026 | | All other domains | June 30, 2026 | ## Why this is happening Coralogix is investing in OpenTelemetry (OTel) as the recommended long-term ingestion approach. OpenTelemetry is the foundation for Coralogix’s most advanced capabilities and enables you to send logs, metrics, and traces from a single pipeline rather than using separate agents and paths. It unlocks powerful correlation between all entitty types to speed up investigations. Filebeat supports logs only. The legacy Filebeat flow depends on a Coralogix-maintained Logstash server. This hosted Logstash service requires ongoing operational work and relies on an older Logstash version, which limits upgrades and creates avoidable risk. ## What’s affected After the end-of-life date for your domain, the Coralogix-hosted Logstash service will no longer accept data. This impacts: * Environments that ship logs using the legacy Filebeat-to-Coralogix hosted Logstash flow. * Any automation, onboarding scripts, or deployment templates that assume Coralogix provides a hosted Logstash endpoint. * Monitoring, alerting, and investigations that rely on those logs (you may see gaps in dashboards and alerts if ingestion stops). This change does not prevent you from using Logstash. If you run Logstash in your own infrastructure, you can continue using Logstash as part of your pipeline. ## What you need to do Confirm whether you are using Coralogix-hosted Logstash. Review your current deployment and look for configurations where Filebeat (or another shipper) forwards logs to a Coralogix-provided Logstash destination. Our Logstash endpoints are `logstashserver.coralogix.com`, `logstash.coralogix.in`, and `logstashserver.coralogix.us`. Then migrate using one of the following options before the end-of-life date for your domain. ### Option A. Migrate to OpenTelemetry (recommended) OpenTelemetry requires more setup than the legacy flow, but it is the recommended long-term solution. What you typically do: * Deploy an OpenTelemetry Collector (Coralogix distribution or your preferred Collector build) * Configure the Collector to receive logs from your environment * Configure export to Coralogix using the endpoint for your Coralogix region and your API key * Validate that logs are arriving in Coralogix, then cut over traffic to the Collector Why choose this: * Supports Coralogix’s most advanced features * One pipeline for logs, metrics, and traces * More future-proof than legacy agent-to-Logstash flows Take [these steps](#replace-filebeat-with-an-opentelemetry-collector). ### Option B. Run your own Logstash instance (self-managed) If you want to keep Logstash in your pipeline, you can run it in your own infrastructure using this [Logstash guide](https://coralogix.com/docs/integrations/files/logstash.md). Coralogix supports the integration, but Coralogix will not host or maintain the Logstash server for you. What you typically do: * Provision and operate Logstash in your environment (including version upgrades and scaling). * Update Filebeat to ship to your Logstash instance. * Configure Logstash to forward data to Coralogix using supported ingestion methods and credentials. * Validate ingestion in Coralogix, then cut over traffic. Take [these steps](#run-your-own-logstash-instance). ## Replace Filebeat with an OpenTelemetry Collector This option applies to customers who are ready to migrate from Filebeat. The structure of the log shipped by otel-collector will be different from your previous logs. The following example demonstrates the difference in Filebeat and OTel log structure: **Filebeat**: ``` { "@timestamp": "2026-02-17T07:39:14.778Z", "tags": [ "beats_input_codec_plain_applied" ], "agent": { "type": "filebeat", "id": "edbabc87-1861-4bff-9192-844d0b7f3c1b", "name": "ubuntu", "version": "9.3.0", "ephemeral_id": "0966c318-476d-4b06-a23f-8cff00ade849" }, "message": "test message", "@version": "1", "input": { "type": "filestream" }, "log": { "file": { "path": "/var/log/test.log" } }, "host": { "name": "ubuntu" }, "ecs": { "version": "8.0.0" } } ``` **OTel**: ``` { "attributes": { "log.file.path": "/var/log/test.log", "log.iostream": "stderr", "time": "2026-02-02T15:16:02.025296299Z" }, "body": "test message", "observedTimeUnixNano": 1770045362115109000, "resource": { "attributes": { "host.id": "777005cbdb064f89b4a297450db02199", "host.name": "otel-lab", } }, "resourceSchemaUrl": "https://opentelemetry.io/schemas/1.37.0", "scope": { "attributes": {} }, "timeUnixNano": 1770045362025296400 } ``` ### Install Install an OpenTelemetry collector using the official [OpenTelemetry instructions](https://opentelemetry.io/docs/collector/install/binary/). ### Configure Here is an example of a basic Filebeat configuration file that reads a log file and ships it to a static application and subsystem. ``` #============================== Filebeat Inputs =============================== filebeat.inputs: - type: log paths: - "/var/log/your_app/your_app.log" fields_under_root: true fields: PRIVATE_KEY: "YOUR_PRIVATE_KEY" COMPANY_ID: YOUR_COMPANY_ID APP_NAME: "APP_NAME" SUB_SYSTEM: "SUB_NAME" #----------------------------- Logstash output -------------------------------- output.logstash: enabled: true hosts: ["logstashserver.eu2.coralogix.com:5015"] ttl: 60s tls.certificate_authorities: ["/ca.crt"] ssl.certificate_authorities: ["/ca.crt"] ``` Here is the equivalent OTel collector configuration to ship a log file. Update the OpenTelemetry Collector configuration using the following as example. ``` receivers: filelog: include: - /var/log/your_app/your_app.log include_file_name: true include_file_path: false retry_on_failure: enabled: true start_at: beginning storage: file_storage processors: batch: send_batch_max_size: 2048 send_batch_size: 1024 timeout: 1s exporters: coralogix: domain: "eu2.coralogix.com" private_key: "cxtp_SendYourDataAPIKey" application_name: "DefaultApplicationName" subsystem_name: "DefaultSubsystemName" application_name_attributes: - "cx.application.name" subsystem_name_attributes: - "cx.subsystem.name" timeout: 30s extensions: file_storage: { directory: /var/log/otelcol } service: extensions: - file_storage pipelines: logs: receivers: - filelog processors: - batch exporters: - coralogix ``` ### Filebeat to OpenTelemetry Processor migration reference The following reference maps common Filebeat processors to their functional equivalents in the OTel Collector. Use it to maintain feature parity and logic consistency while migrating telemetry pipelines to vendor-neutral architecture. | Use case | Filebeat processor | OpenTelemetry processor | Example | | ------------------------------------- | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | | Add host metadata | [add\_host\_metadata](https://www.elastic.co/docs/reference/beats/filebeat/add-host-metadata) | [resourcedetection](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/resourcedetectionprocessor) | [YAML](#example-add-host-metadata) | | Add cloud metadata | [add\_cloud\_metadata](https://www.elastic.co/docs/reference/beats/filebeat/add-cloud-metadata) | [resourcedetection](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/resourcedetectionprocessor) | [YAML](#example-add-cloud-metadata) | | Remove fields from JSON logs | [drop\_fields](https://www.elastic.co/docs/reference/beats/filebeat/drop-fields) | [transform](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/transformprocessor) | [OTTL](#example-remove-fields-from-json-logs) | | Convert valid JSON strings to objects | [decode\_json\_fields](https://www.elastic.co/docs/reference/beats/filebeat/decode-json-fields) | [transform](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/transformprocessor) | [OTTL](#example-convert-valid-json-strings-to-objects) | | Change the name of a field | [rename](https://www.elastic.co/docs/reference/beats/filebeat/rename-fields) | [transform](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/transformprocessor) | [OTTL](#example-change-the-name-of-a-field) | | Filter or drop logs | [drop\_event](https://www.elastic.co/docs/reference/beats/filebeat/drop-event) | [filter](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/filterprocessor) | [YAML](#example-filter-or-drop-logs) | ### Example: Add host metadata ``` processors: resourcedetection: detectors: - host ``` ### Example: Add cloud metadata ``` processors: resourcedetection: detectors: - ec2 ``` ### Example: Remove fields from JSON logs ``` processors: transform: log_statements: - 'delete_key(log.body["fieldName"])' ``` ### Example: Convert valid JSON strings to objects ``` processors: transform: log_statements: - 'set(log.body["json"], ParseJSON(log.body["json_string"])) where IsMatch(log.body["json_string"], "\\{")' ``` ### Example: Change the name of a field ``` processors: transform: log_statements: - 'set(log.body["new"], log.body["old"])' - 'delete_key(log.body["old"])' ``` ### Example: Filter or drop logs ``` processors: filter: error_mode: ignore logs: log_record: - 'IsMatch(body, ".*blocked log.*")' ``` Explore the [official OpenTelemetry documentation](https://opentelemetry.io/docs/collector/components/processor/) to discover additional processors and the full library of [OTTL functions](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/pkg/ottl/ottlfuncs) available for advanced telemetry processing. ## Run your own Logstash instance ### Install Install a self-hosted logstash instance using the [official Elastic Logstash installation instructions](https://www.elastic.co/docs/reference/logstash/installing-logstash). ### Configure Update your Filebeat configuration to enable shipping to a self-hosted Logstash instance. Here is a legacy example of Filebeat shipping to Coralogix logstash configuration: ``` #============================== Filebeat Inputs =============================== filebeat.inputs: - type: log paths: - "/var/log/your_app/your_app.log" fields_under_root: true fields: PRIVATE_KEY: "YOUR_PRIVATE_KEY" COMPANY_ID: YOUR_COMPANY_ID APP_NAME: "APP_NAME" SUB_SYSTEM: "SUB_NAME" #----------------------------- Logstash output -------------------------------- output.logstash: enabled: true hosts: ["logstashserver.eu2.coralogix.com:5015"] ttl: 60s tls.certificate_authorities: ["/ca.crt"] ssl.certificate_authorities: ["/ca.crt"] ``` **New configuration example**: ``` #============================== Filebeat Inputs =============================== filebeat.inputs: - type: log paths: - "/var/log/your_app/your_app.log" #----------------------------- Logstash output -------------------------------- output.logstash: enabled: true hosts: [":5044"] ``` Update the configuration of your self-hosted Logstash instance. Use the example below to receive Filebeat logs. Add metadata and ship it to Coralogix. ``` input { beats { port => 5044 } } filter { ruby {code => " event.set('[@metadata][application]', APP_NAME) event.set('[@metadata][subsystem]', SUB_NAME) event.set('[@metadata][event]', event.to_json) event.set('[@metadata][host]', event.get('host')) "} } output { http { url => "https://ingress.eu1.coralogix.com/logs/v1/singles" http_method => "post" headers => ["authorization", "Bearer "] format => "json_batch" codec => "json" mapping => { "applicationName" => "%{[@metadata][application]}" "subsystemName" => "%{[@metadata][subsystem]}" "computerName" => "%{[@metadata][host]}" "text" => "%{[@metadata][event]}" } http_compression => true automatic_retries => 5 retry_non_idempotent => true connect_timeout => 30 keepalive => false } } ``` ### Best practices We can recommend a starting point of at least 8GB RAM / 4 CPU cores / SSD storage. Adjust up or down from there depending on your needs. ## What happens after the end-of-life date * The Coralogix-hosted Logstash service will be permanently shut down. * Any workloads still sending logs through the hosted Logstash service will stop ingesting into Coralogix. * Dashboards, alerts, and monitoring that rely on those logs may show missing data after the cutoff. ## Need help? Contact Coralogix Support through the in-app chat (24/7) or reach out to your Technical Account Manager.