Logstash
Logstash is maintained in the observability catalog as ingestion pipeline with an explicit evidence and lifecycle record.
The current entry and its direct relationships are prominent; every other catalog technology and concept remains visible as muted background context.
18 directly connected nodes · 18 typed relationships · 203 muted catalog entries
List direct catalog relationships
- CatalogObservability Technology
- RelatedElastic Observability
- RelatedElasticsearch
- RelatedKibana
- RelatedElastic Stack
- TelemetryMetrics
- TelemetryLogs
- TelemetryEvents
- ArchitectureHost Observability
- ArchitectureMicroservices Observability
- ArchitectureOn-Premise Observability
- FunctionAd-Hoc Functions
- FunctionQuerying
- FunctionData Collection
- FunctionTelemetry Processing
- FunctionTelemetry Routing
- FunctionIntegrations
- RelatedELK Stack
Catalog position
Logstash is maintained by Elastic and classified as ingestion pipeline in the telemetry pipeline research cohort [1]. This establishes a stable catalog identity and a canonical starting source; it does not independently validate product outcomes, pricing, availability, or fit.
| Field | Catalog record |
|---|---|
| Entity type | Product |
| Signals | Logs, Events, Metrics |
| Deployment | Self Hosted |
| License model | Elastic License and Apache-2.0 components |
| Origin | Global |
Shared technology-map evidence
Logstash covers two common capability families: collection/processing and telemetry routing. It is not scored as a log backend, dashboard, APM system, or alert manager [1]. The reference cost is a small self-hosted compute and operator allowance. Breadth uses the official repository's approximately 14,900 stars, 3,500 forks, and documented ecosystem of more than 200 plugins [2].
Research stance
Treat this page as a maintainable evidence record, not an endorsement or direct ranking. Challenge the stance when the classification, evidence, or stated limits no longer match current primary evidence.
Technology-map evidence
How this tool is positioned
- Capability coverage
- 17% 2 of 12 families
- Reference cost
- $30per capability / month
- Market breadth
- 72/100 bounded evidence index
- Confidence
- documenteddocumented inputs
Focused collection and processing pipeline; cost is the self-hosted allowance.
Axis sources: Logstash documentation · elastic/logstash
Source record
Bibliography
Elastic, “Logstash documentation.” [Online]. Available: https://www.elastic.co/guide/en/logstash/current/index.html. [Accessed: Aug. 12, 2026].
Canonical first-party or project documentation used for catalog identity and stated scope.Canonical source ↗Return to article ↑Elastic, “elastic/logstash.” GitHub. [Online]. Available: https://github.com/elastic/logstash. [Accessed: Aug. 14, 2026].
Public stars forks and plugin-ecosystem evidence used in the breadth index.Canonical source ↗Return to article ↑Elastic, “Elastic subscriptions and free tier.” [Online]. Available: https://www.elastic.co/subscriptions. [Accessed: Aug. 14, 2026].
Official price-list or product-site reference. Availability: free-open-source.Canonical source ↗Return to article ↑Elastic, “Official GitHub repository.” GitHub. [Online]. Available: https://github.com/elastic/logstash. [Accessed: Aug. 14, 2026].
Known limits
Unresolved unknowns
- Current editions, pricing, availability, and independently measured outcomes require dated verification.
Public review
Discuss and correct
Comments are public. Proposed factual corrections must be incorporated into version-controlled research before they are treated as published.
Local preview does not have Giscus configured. Native comments and Giscus are never presented as competing primary systems on the same page.