Logstash plugin for log forwarding

Use our Logstash output plugin to connect your Logstash monitored log data to New Relic. Read on to learn how to enable this feature.

Compatibility and requirements

To forward your logs to New Relic using Logstash, ensure your configuration meets the following requirements:

• New Relic license key (recommended) or Insert API key
• Logstash 6.6 or higher
  • Logstash requires Java 8 or Java 11. Use the official Oracle distribution or an open-source distribution such as OpenJDK.

Enable Logstash for log management

To enable log management using Logstash:

1. Install the Logstash plugin.
2. Configure the Logstash plugin.
3. Optional: Configure additional plugin attributes.
4. Test the Logstash plugin.
5. Generate some traffic and wait a few minutes, then check your account for data.

Install the Logstash plugin

To install the Logstash plugin, enter the following command into your terminal or command line interface:

logstash-plugin install logstash-output-newrelic

Configure the Logstash plugin

To configure your Logstash plugin:

1. In your logstash.conf file, add the following block of data. Be sure to replace the placeholder text with your New Relic license key or Insights Insert key.

   Configure with the New Relic license key (recommended):

   output {
     newrelic {
       license_key => "LICENSE_KEY"
     }
   }

   Copy

   Or, configure with the New Relic Insert API key:

   output {
     newrelic {
       api_key => "INSERT_API_KEY"
     }
   }

   Copy

2. Restart your Logstash instance.

Optional configuration

Once you have installed and configured the Logstash plugin, you can use the following attributes to configure how the plugin sends data to New Relic:

For more information on adding or configuring attributes, see Example Configurations for Logstash.

Test the Logstash plugin

To test if your Logstash plugin is receiving input from a log file:

1. Add the following to your logstash.conf file:

   input {
       file {
         path => "/PATH/TO/YOUR/LOG/FILE"
       }
   }

   Copy

2. Restart your Logstash instance.

3. Run the following command to append a test log message to your log file:

   echo "test message" >> /PATH/TO/YOUR/LOG/FILE

   Copy

4. Search New Relic Logs UI for test message.

View log data

If everything is configured correctly and your data is being collected, you should see data logs in both of these places:

• New Relic Logs UI

• New Relic tools for running NRQL queries. For example, you can execute a query like this:

  SELECT * FROM Log

  Copy

What's next?

Now that you've enabled Logs, here are some potential next steps:

• Explore your data using the Logs UI.
• Configure your agent to see contextual log data, such as distributed tracing, stack traces, application logs, and more.
• Query your data and create custom dashboards or alerts.

If no data appears after you enable New Relic Logs, follow the troubleshooting procedures.