Logstash plugin for log forwarding

If your log data is already being monitored by Logstash, you can use our Logstash plugin to forward and enrich your log data in New Relic.

Forwarding your Logstash logs to New Relic will give you enhanced capabilities to collect, process, explore, query, and alert on your log data.

Enable Logstash for log management

To forward your logs from Logstash to New Relic:

Make sure you have:
- A New Relic
- Logstash version 6.6 or higher with Java 8 or Java 11. Use the official Oracle distribution or an open-source distribution such as OpenJDK.
Install and configure the Logstash plugin.
Optional: Configure additional plugin attributes.
Test the Logstash plugin.
Generate some traffic and wait a few minutes, then check your account for data.

Install and configure the Logstash plugin

To forward your logs to New Relic with our Logstash plugin:

Enter the following command into your terminal or command line interface:
bash
```
$logstash-plugin install logstash-output-newrelic
```
In your logstash.conf file, add the following block of data. Be sure to replace the placeholder text with your New Relic .
```
output {
  newrelic {
    license_key => "LICENSE_KEY"
  }
}
```
Restart your Logstash instance.

Did this doc help with your installation?

Optional configuration

After you install and configure the Logstash plugin, you can use the following attributes to configure how the plugin sends data to New Relic. For more information on adding or configuring attributes, see our Logstash configuration examples in GitHub.

Property	Description
`concurrent_requests`	The number of threads to make requests from. Default: `1`
`base_uri`	The New Relic ingestion endpoint. US endpoint: `https://log-api.newrelic.com/log/v1` EU endpoint: `https://log-api.eu.newrelic.com/log/v1`
`max_retries`	Maximum number attempts to retry to send a message. If set to `0`, no re-attempts will be made. Default: `3`

Property

Description

concurrent_requests

The number of threads to make requests from. Default: 1

base_uri

The New Relic ingestion endpoint.

US endpoint: https://log-api.newrelic.com/log/v1
EU endpoint: https://log-api.eu.newrelic.com/log/v1

max_retries

Maximum number attempts to retry to send a message. If set to 0, no re-attempts will be made. Default: 3

Test the Logstash plugin

To test if your Logstash plugin is receiving input from a log file:

Add the following to your logstash.conf file:

input {
  file {
    path => "/PATH/TO/YOUR/LOG/FILE"
  }
}

Restart your Logstash instance.
Run the following command to append a test log message to your log file:
bash
```
$echo "test message" >> /PATH/TO/YOUR/LOG/FILE
```
Search our logs UI for test message.

View log data

If everything is configured correctly and your data is being collected, you should see log data in both of these places:

Our logs UI
Our tools for running NRQL queries. For example, you can execute a query like this:

SELECT * FROM Log

If no data appears after you enable our log management capabilities, follow our standard log troubleshooting procedures.

What's next?

Explore logging data across your platform with our logs UI.

Get deeper visibility into both your application and your platform performance data by forwarding your logs with our logs in context capabilities.
Set up alerts.
Query your data and create dashboards.

Disable log forwarding

To disable log forwarding capabilities, follow standard procedures in Logstash documentation. You do not need to do anything else in New Relic.

Enable Logstash for log management .css-21sua1{background:none;border:none;width:0;padding:0;}