Logstash - transport and process your logs, events, or other data
Find a file
2014-04-09 13:41:40 -04:00
bin Actually clear GEM_PATH 2014-03-12 14:00:23 -07:00
bot Warm welcome to bot,may it serves you well 2013-03-11 07:13:54 +01:00
docs replace bluecloth with kramdown pure-ruby markdown parser 2014-04-03 13:59:44 -04:00
lib removed assess_jruby! & renamed spec/environment.rb 2014-04-09 13:41:40 -04:00
locales On config failure, tell users about --configtest 2014-01-31 09:44:42 -08:00
patterns Improve RFC-5424 app, proc and msgid matching 2014-04-07 11:19:28 +02:00
pkg Fixed RPM license linting error 2014-03-23 01:39:59 -04:00
spec removed assess_jruby! & renamed spec/environment.rb 2014-04-09 13:41:40 -04:00
test/jenkins - purge old and unused 'test' directory (everything is rspec now) 2013-06-23 22:57:42 -07:00
tools Add s3 upload 2014-03-19 18:25:09 -07:00
.gitignore Ignore the .VERSION.mk file 2013-11-19 08:35:11 +01:00
.tailor - add .tailor config 2012-12-03 16:04:27 -08:00
.travis.yml rspec wasn't in PATH, adding --debug flag to jvm args 2013-09-25 14:33:32 -06:00
CHANGELOG Update changelog 2014-03-20 01:26:46 +00:00
CONTRIBUTING.md - add CONTRIBUTING docs 2013-09-16 17:23:37 -07:00
CONTRIBUTORS Updates contributors 2014-02-14 18:52:07 -02:00
extract_services.rb - Merge META-INF/services/* files from dependency jars. (#486) 2013-05-28 16:46:43 -07:00
gembag.rb Try more times to fetch from rubygems.org 2014-02-28 11:56:43 -08:00
LICENSE it's 2013! 2013-01-01 21:07:00 -08:00
logstash-event.gemspec . 2013-09-11 11:02:20 -07:00
logstash.gemspec replace bluecloth with kramdown pure-ruby markdown parser 2014-04-03 13:59:44 -04:00
Makefile also run deep specs with make test 2014-04-08 23:29:02 -04:00
pull_release_note.rb Make release note from JIRA and Github 2013-03-11 07:11:23 +01:00
README.md Remove references to flatjar or jar or java invocations. 1.4.0+ no longer provides this 2014-03-17 17:10:26 -07:00
require-analyze.rb - hacky script to analyze the DEBUG=require csv output grouped by 2013-12-07 12:13:04 -08:00
STYLE.md - clean up style guide a bit 2013-01-03 17:23:36 -08:00

Logstash

Logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, Logstash comes with a web interface for searching and drilling into all of your logs.

It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.

For more info, see http://logstash.net/

Need Help?

Need help? Try #logstash on freenode irc or the logstash-users@googlegroups.com mailing list.

You can also find documentation on the http://logstash.net site.

Developing

If you don't have JRuby already (or don't use rvm, rbenv, etc), you can have bin/logstash fetch it for you by setting USE_JRUBY:

USE_JRUBY=1 bin/logstash ...

Otherwise, here's how to get started with rvm:

# Install JRuby with rvm
rvm install jruby-1.7.11
rvm use jruby-1.7.11

Now install dependencies:

# Install logstash ruby dependencies
bin/logstash deps

Other commands:

# to use Logstash gems or libraries in irb, use the following
# this gets you an 'irb' shell with Logstash's environment
bin/logstash irb

# Run Logstash
bin/logstash agent [options]

# If running bin/logstash agent yields complaints about log4j/other things
# This will download the elasticsearch jars so Logstash can use them.
make vendor-elasticsearch

Testing

There are a few ways to run the tests. For development, using bin/logstash rspec <some spec> will suffice:

% bin/logstash rspec spec/filters/grok.rb 
...................

Finished in 0.123 seconds
19 examples, 0 failures

Alternately, if you have just built the tarball, you can run the tests specifically on those like so:

make tarball-test

If you want to run all the tests from source, do:

make test

Building

Building is not required. You are highly recommended to download the releases we provide from the Logstash site!

If you want to build the release tarball yourself, run:

make tarball

You can build rpms and debs, if you need those. Building rpms requires you have fpm, then do this:

make package

Project Principles

  • Community: If a newbie has a bad time, it's a bug.
  • Software: Make it work, then make it right, then make it fast.
  • Technology: If it doesn't do a thing today, we can make it do it tomorrow.

Contributing

All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.

Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.

It is more important to me that you are able to contribute.

For more information about contributing, see the CONTRIBUTING file.