Skip to content

[Enhancement] Adding processor, preserve_original_event and tag to logstash log manifest #18316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sbaas-hcs wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[Enhancement] Adding processor, preserve_original_event and tag to logstash log manifest #18316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e62ff58
Adding processor, preserve_original_event and tag as option to logsta…
sbaas-hcs Apr 9, 2026
ad3dac5
Updated changelog/manifest
sbaas-hcs Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions packages/logstash/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,14 @@
# newer versions go on top
- version: "2.10.3"
changes:
- description: Adding processor, preserve_original_event and tag as option to logstash stream.
type: enhancement
link: https://github.com/elastic/integrations/pull/18316
- version: "2.10.2"
changes:
- description: Added logstash-json to default, if log.format is changed https://www.elastic.co/docs/reference/logstash/logstash-settings-file.
type: enhancement
link: https://github.com/elastic/integrations/pull/18316
Comment on lines +2 to +11
Copy link
Copy Markdown
Member

@andsel andsel Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @sbaas-hcs
I think it's best or to have 2 PR one for each patch version or collapse all in one.

- version: "2.10.1"
changes:
- description: Fixes navigation of batch metrics when the integration is used to monitor an older version of Logstash that doesn't expose.
Expand Down
10 changes: 10 additions & 0 deletions packages/logstash/data_stream/log/agent/stream/log.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@ processors:
target: ''
fields:
ecs.version: 1.10.0
{{#if processors}}
{{processors}}
{{/if}}
tags:
{{#if preserve_original_event}}
- preserve_original_event
{{/if}}
{{#each tags as |tag|}}
- {{tag}}
{{/each}}
{{#if condition}}
condition: {{ condition }}
{{/if}}
24 changes: 24 additions & 0 deletions packages/logstash/data_stream/log/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,30 @@ streams:
show_user: true
default:
- /var/log/logstash/logstash-plain*.log
- /var/log/logstash/logstash-json*.log
- name: tags
type: text
title: Tags
multi: true
required: false
show_user: false
default:
- name: processors
type: yaml
title: Processors
multi: false
required: false
show_user: false
description: >
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
- name: preserve_original_event
required: true
show_user: true
title: Preserve original event
description: Preserves a raw copy of the original event, added to the field `event.original`
type: bool
multi: false
default: false
template_path: log.yml.hbs
title: Logstash logs
description: Collect Logstash logs from standard files
10 changes: 10 additions & 0 deletions packages/logstash/data_stream/slowlog/agent/stream/log.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,16 @@ processors:
target: ''
fields:
ecs.version: 1.10.0
{{#if processors}}
{{processors}}
{{/if}}
tags:
{{#if preserve_original_event}}
- preserve_original_event
{{/if}}
{{#each tags as |tag|}}
- {{tag}}
{{/each}}
{{#if condition}}
condition: {{ condition }}
{{/if}}
24 changes: 24 additions & 0 deletions packages/logstash/data_stream/slowlog/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,30 @@ streams:
show_user: true
default:
- /var/log/logstash/logstash-slowlog-plain*.log
- /var/log/logstash/logstash-slowlog-json*.log
- name: tags
type: text
title: Tags
multi: true
required: false
show_user: false
default:
- name: processors
type: yaml
title: Processors
multi: false
required: false
show_user: false
description: >
Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.
- name: preserve_original_event
required: true
show_user: true
title: Preserve original event
description: Preserves a raw copy of the original event, added to the field `event.original`
type: bool
multi: false
default: false
template_path: log.yml.hbs
title: Logstash slowlog logs
description: Collect logstash slowlog logs using log input
2 changes: 1 addition & 1 deletion packages/logstash/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: logstash
title: Logstash
version: 2.10.1
version: 2.10.3
description: Collect logs and metrics from Logstash with Elastic Agent.
type: integration
icons:
Expand Down