You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,3 +1,6 @@
1
+
## 6.1.6
2
+
-[DOC] Applied more attributes to manage plugin name in doc content, and implemented conditional text processing. [#423](https://github.com/logstash-plugins/logstash-input-http/pull/423)
3
+
1
4
## 6.1.5
2
5
- Changed jar dependencies to reflect newer versions [#425](https://github.com/logstash-plugins/logstash-input-beats/pull/425)
The following example shows how to configure Logstash to listen on port
32
34
5044 for incoming {plugin-uc} connections and to index into Elasticsearch.
33
35
36
+
//Example for Beats
37
+
ifeval::["{plugin}"=="beats"]
34
38
["source","sh",subs="attributes"]
35
39
-----
36
40
@@ -48,9 +52,8 @@ output {
48
52
}
49
53
-----
50
54
<1> `%{[@metadata][beat]}` sets the first part of the index name to the value
51
-
of the `beat` metadata field and `%{[@metadata][version]}` sets the second part to
52
-
the {plugin-uc} version. For example:
53
-
metricbeat-7.4.0.
55
+
of the metadata field and `%{[@metadata][version]}` sets the second part to
56
+
the {plugin-singular} version. For example: metricbeat-6.1.6.
54
57
55
58
Events indexed into Elasticsearch with the Logstash configuration shown here
56
59
will be similar to events directly indexed by {plugin-uc} into Elasticsearch.
@@ -59,14 +62,56 @@ NOTE: If ILM is not being used, set `index` to
59
62
`%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}` instead so
60
63
Logstash creates an index per day, based on the `@timestamp` value of the events
61
64
coming from {plugin-uc}.
65
+
endif::[]
62
66
63
-
IMPORTANT: If you are shipping events that span multiple lines, you need to use
67
+
//Example for Elastic Agent
68
+
ifeval::["{plugin}"!="beats"]
69
+
["source","sh",subs="attributes"]
70
+
-----
71
+
72
+
input {
73
+
{plugin} {
74
+
port => 5044
75
+
}
76
+
}
77
+
78
+
output {
79
+
elasticsearch {
80
+
hosts => ["http://localhost:9200"]
81
+
data_stream => "true"
82
+
}
83
+
}
84
+
-----
85
+
86
+
Events indexed into Elasticsearch with the Logstash configuration shown here
87
+
will be similar to events directly indexed by {plugin-uc} into Elasticsearch.
88
+
endif::[]
89
+
90
+
91
+
//Content for Beats
92
+
ifeval::["{plugin}"=="beats"]
93
+
[id="plugins-{type}s-{plugin}-multiline"]
94
+
===== Multi-line events
95
+
96
+
If you are shipping events that span multiple lines, you need to use
64
97
the {filebeat-ref}/multiline-examples.html[configuration options available in
65
98
Filebeat] to handle multiline events before sending the event data to Logstash.
66
99
You cannot use the {logstash-ref}/plugins-codecs-multiline.html[Multiline codec
67
100
plugin] to handle multiline events. Doing so will result in the failure to start
68
101
Logstash.
102
+
endif::[]
103
+
104
+
//Content for Elastic Agent
105
+
ifeval::["{plugin}"!="beats"]
106
+
[id="plugins-{type}s-{plugin}-limitations"]
107
+
===== Elastic Agent and Fleet limitations
108
+
109
+
Early releases of Elastic Agent and Fleet have some limitations, including support for advanced Beats settings like multiline, processors, and so forth.
110
+
For more information, see {fleet-guide}/fleet-limitations.html[Limitations of this release].
111
+
endif::[]
69
112
113
+
//Content for Beats
114
+
ifeval::["{plugin}"=="beats"]
70
115
[id="plugins-{type}s-{plugin}-versioned-indexes"]
71
116
==== Versioned indices
72
117
@@ -89,6 +134,7 @@ Logstash `@timestamp` field.
89
134
90
135
This configuration results in daily index names like
|[host] |[@metadata][input][beats][host][name] |Always |Name or address of the beat host
110
-
|[@metadata][ip_address] |[@metadata][input][beats][host][ip] |Always |IP address of the Beats client
155
+
|[host] |[@metadata][input][beats][host][name] |Always |Name or address of the {plugin-singular} host
156
+
|[@metadata][ip_address] |[@metadata][input][beats][host][ip] |Always |IP address of the {plugin-uc} client
111
157
|[@metadata][tls_peer][status] | [@metadata][tls_peer][status] | When SSL related fields are populated | Contains "verified"/"unverified" labels in `disabled`, `true`/`false` in `v1`
112
158
|[@metadata][tls_peer][protocol] | [@metadata][input][beats][tls][version_protocol] | When SSL status is "verified" | Contains the TLS version used (e.g. `TLSv1.2`)
113
159
|[@metadata][tls_peer][subject] | [@metadata][input][beats][tls][client][subject] | When SSL status is "verified" | Contains the identity name of the remote end (e.g. `CN=artifacts-no-kpi.elastic.co`)
114
160
|[@metadata][tls_peer][cipher_suite] | [@metadata][input][beats][tls][cipher] | When SSL status is "verified" | Contains the name of cipher suite used (e.g. `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`)
0 commit comments