Logstash APIs enable you to manage pipelines that are used by Logstash Central Management.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/elastic:elastic-logstash-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Elasticsearch Logstash API
description: 'Elasticsearch provides REST APIs that are used by the UI components and can be called directly to configure and access Elasticsearch features.
## Documentation source and versions
This documentation is derived from the main branch of the elasticsearch-specification repository. It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.
This documentation contains work-in-progress information for future Elastic Stack releases.'
license:
name: Apache 2.0
url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
version: ''
security:
- apiKeyAuth: []
- basicAuth: []
- bearerAuth: []
tags:
- name: logstash
description: Logstash APIs enable you to manage pipelines that are used by Logstash Central Management.
externalDocs:
description: Learn more.
url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
x-displayName: Logstash
paths:
/_logstash/pipeline/{id}:
get:
tags:
- logstash
summary: Get Logstash pipelines
description: Get pipelines that are used for Logstash Central Management.
externalDocs:
description: Centralized pipeline management
url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-get-pipeline.html
operationId: logstash-get-pipeline-1
parameters:
- in: path
name: id
description: A comma-separated list of pipeline identifiers.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Ids'
style: simple
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
additionalProperties:
$ref: '#/components/schemas/logstash._types.Pipeline'
examples:
LogstashGetPipelineResponseExample1:
description: 'A successful response from `GET _logstash/pipeline/my_pipeline`.
'
value: "{\n \"my_pipeline\": {\n \"description\": \"Sample pipeline for illustration purposes\",\n \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n \"pipeline_metadata\": {\n \"type\": \"logstash_pipeline\",\n \"version\": \"1\"\n },\n \"username\": \"elastic\",\n \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n \"pipeline_settings\": {\n \"pipeline.workers\": 1,\n \"pipeline.batch.size\": 125,\n \"pipeline.batch.delay\": 50,\n \"queue.type\": \"memory\",\n \"queue.max_bytes\": \"1gb\",\n \"queue.checkpoint.writes\": 1024\n }\n }\n}"
x-state: Generally available; Added in 7.12.0
x-variations:
- "<div>\n <span class=\"operation-verb get\">GET</span>\n <span class=\"operation-path\">/_logstash/pipeline/{id}</span>\n </div>\n "
x-req-auth:
- 'Cluster privileges: `manage_logstash_pipelines`
'
x-api: get_pipeline.logstash
x-category: ingest
x-codeSamples:
- lang: Console
source: 'GET _logstash/pipeline/my_pipeline
'
- lang: Python
source: "resp = client.logstash.get_pipeline(\n id=\"my_pipeline\",\n)"
- lang: JavaScript
source: "const response = await client.logstash.getPipeline({\n id: \"my_pipeline\",\n});"
- lang: Ruby
source: "response = client.logstash.get_pipeline(\n id: \"my_pipeline\"\n)"
- lang: PHP
source: "$resp = $client->logstash()->getPipeline([\n \"id\" => \"my_pipeline\",\n]);"
- lang: curl
source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
- lang: Java
source: "client.logstash().getPipeline(g -> g\n .id(\"my_pipeline\")\n);\n"
x-metaTags:
- content: Elasticsearch, Logstash
name: product_name
put:
tags:
- logstash
summary: Create or update a Logstash pipeline
description: 'Create a pipeline that is used for Logstash Central Management.
If the specified pipeline exists, it is replaced.'
externalDocs:
description: Centralized pipeline management
url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-put-pipeline.html
operationId: logstash-put-pipeline
parameters:
- in: path
name: id
description: 'An identifier for the pipeline.
Pipeline IDs must begin with a letter or underscore and contain only letters, underscores, dashes, hyphens and numbers.'
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Id'
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/logstash._types.Pipeline'
examples:
LogstashPutPipelineRequestExample1:
summary: Create a pipeline
description: Run `PUT _logstash/pipeline/my_pipeline` to create a pipeline.
value: "{\n \"description\": \"Sample pipeline for illustration purposes\",\n \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n \"pipeline_metadata\": {\n \"type\": \"logstash_pipeline\",\n \"version\": 1\n },\n \"username\": \"elastic\",\n \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n \"pipeline_settings\": {\n \"pipeline.workers\": 1,\n \"pipeline.batch.size\": 125,\n \"pipeline.batch.delay\": 50,\n \"queue.type\": \"memory\",\n \"queue.max_bytes\": \"1gb\",\n \"queue.checkpoint.writes\": 1024\n }\n}"
required: true
responses:
'200':
description: ''
content:
application/json: {}
x-state: Generally available; Added in 7.12.0
x-variations:
- "<div>\n <span class=\"operation-verb put\">PUT</span>\n <span class=\"operation-path\">/_logstash/pipeline/{id}</span>\n </div>\n "
x-req-auth:
- 'Cluster privileges: `manage_logstash_pipelines`
'
x-api: put_pipeline.logstash
x-category: ingest
x-codeSamples:
- lang: Console
source: "PUT _logstash/pipeline/my_pipeline\n{\n \"description\": \"Sample pipeline for illustration purposes\",\n \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n \"pipeline_metadata\": {\n \"type\": \"logstash_pipeline\",\n \"version\": 1\n },\n \"username\": \"elastic\",\n \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n \"pipeline_settings\": {\n \"pipeline.workers\": 1,\n \"pipeline.batch.size\": 125,\n \"pipeline.batch.delay\": 50,\n \"queue.type\": \"memory\",\n \"queue.max_bytes\": \"1gb\",\n \"queue.checkpoint.writes\": 1024\n }\n}"
- lang: Python
source: "resp = client.logstash.put_pipeline(\n id=\"my_pipeline\",\n pipeline={\n \"description\": \"Sample pipeline for illustration purposes\",\n \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n \"pipeline_metadata\": {\n \"type\": \"logstash_pipeline\",\n \"version\": 1\n },\n \"username\": \"elastic\",\n \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n \"pipeline_settings\": {\n \"pipeline.workers\": 1,\n \"pipeline.batch.size\": 125,\n \"pipeline.batch.delay\": 50,\n \"queue.type\": \"memory\",\n \"queue.max_bytes\": \"1gb\",\n \"queue.checkpoint.writes\": 1024\n }\n },\n)"
- lang: JavaScript
source: "const response = await client.logstash.putPipeline({\n id: \"my_pipeline\",\n pipeline: {\n description: \"Sample pipeline for illustration purposes\",\n last_modified: \"2021-01-02T02:50:51.250Z\",\n pipeline_metadata: {\n type: \"logstash_pipeline\",\n version: 1,\n },\n username: \"elastic\",\n pipeline: \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n pipeline_settings: {\n \"pipeline.workers\": 1,\n \"pipeline.batch.size\": 125,\n \"pipeline.batch.delay\": 50,\n \"queue.type\": \"memory\",\n \"queue.max_bytes\": \"1gb\",\n \"queue.checkpoint.writes\": 1024,\n },\n },\n});"
- lang: Ruby
source: "response = client.logstash.put_pipeline(\n id: \"my_pipeline\",\n body: {\n \"description\": \"Sample pipeline for illustration purposes\",\n \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n \"pipeline_metadata\": {\n \"type\": \"logstash_pipeline\",\n \"version\": 1\n },\n \"username\": \"elastic\",\n \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n \"pipeline_settings\": {\n \"pipeline.workers\": 1,\n \"pipeline.batch.size\": 125,\n \"pipeline.batch.delay\": 50,\n \"queue.type\": \"memory\",\n \"queue.max_bytes\": \"1gb\",\n \"queue.checkpoint.writes\": 1024\n }\n }\n)"
- lang: PHP
source: "$resp = $client->logstash()->putPipeline([\n \"id\" => \"my_pipeline\",\n \"body\" => [\n \"description\" => \"Sample pipeline for illustration purposes\",\n \"last_modified\" => \"2021-01-02T02:50:51.250Z\",\n \"pipeline_metadata\" => [\n \"type\" => \"logstash_pipeline\",\n \"version\" => 1,\n ],\n \"username\" => \"elastic\",\n \"pipeline\" => \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n \"pipeline_settings\" => [\n \"pipeline.workers\" => 1,\n \"pipeline.batch.size\" => 125,\n \"pipeline.batch.delay\" => 50,\n \"queue.type\" => \"memory\",\n \"queue.max_bytes\" => \"1gb\",\n \"queue.checkpoint.writes\" => 1024,\n ],\n ],\n]);"
- lang: curl
source: 'curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"description":"Sample pipeline for illustration purposes","last_modified":"2021-01-02T02:50:51.250Z","pipeline_metadata":{"type":"logstash_pipeline","version":1},"username":"elastic","pipeline":"input {}\\n filter { grok {} }\\n output {}","pipeline_settings":{"pipeline.workers":1,"pipeline.batch.size":125,"pipeline.batch.delay":50,"queue.type":"memory","queue.max_bytes":"1gb","queue.checkpoint.writes":1024}}'' "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
- lang: Java
source: "client.logstash().putPipeline(p -> p\n .id(\"my_pipeline\")\n .pipeline(pi -> pi\n .description(\"Sample pipeline for illustration purposes\")\n .lastModified(DateTime.of(\"2021-01-02T02:50:51.250Z\"))\n .pipeline(\"input {}\\n filter { grok {} }\\n output {}\")\n .pipelineMetadata(pip -> pip\n .type(\"logstash_pipeline\")\n .version(\"1\")\n )\n .pipelineSettings(pip -> pip\n .pipelineWorkers(1)\n .pipelineBatchSize(125)\n .pipelineBatchDelay(50)\n .queueType(\"memory\")\n .queueMaxBytes(\"1gb\")\n .queueCheckpointWrites(1024)\n )\n .username(\"elastic\")\n )\n);\n"
x-metaTags:
- content: Elasticsearch, Logstash
name: product_name
delete:
tags:
- logstash
summary: Delete a Logstash pipeline
description: 'Delete a pipeline that is used for Logstash Central Management.
If the request succeeds, you receive an empty response with an appropriate status code.'
externalDocs:
description: Centralized pipeline management
url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-delete-pipeline.html
operationId: logstash-delete-pipeline
parameters:
- in: path
name: id
description: An identifier for the pipeline.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Id'
style: simple
responses:
'200':
description: ''
content:
application/json: {}
x-state: Generally available; Added in 7.12.0
x-variations:
- "<div>\n <span class=\"operation-verb delete\">DELETE</span>\n <span class=\"operation-path\">/_logstash/pipeline/{id}</span>\n </div>\n "
x-req-auth:
- 'Cluster privileges: `manage_logstash_pipelines`
'
x-api: delete_pipeline.logstash
x-category: ingest
x-codeSamples:
- lang: Console
source: 'DELETE _logstash/pipeline/my_pipeline
'
- lang: Python
source: "resp = client.logstash.delete_pipeline(\n id=\"my_pipeline\",\n)"
- lang: JavaScript
source: "const response = await client.logstash.deletePipeline({\n id: \"my_pipeline\",\n});"
- lang: Ruby
source: "response = client.logstash.delete_pipeline(\n id: \"my_pipeline\"\n)"
- lang: PHP
source: "$resp = $client->logstash()->deletePipeline([\n \"id\" => \"my_pipeline\",\n]);"
- lang: curl
source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
- lang: Java
source: "client.logstash().deletePipeline(d -> d\n .id(\"my_pipeline\")\n);\n"
x-metaTags:
- content: Elasticsearch, Logstash
name: product_name
/_logstash/pipeline:
get:
tags:
- logstash
summary: Get Logstash pipelines
description: Get pipelines that are used for Logstash Central Management.
externalDocs:
description: Centralized pipeline management
url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-get-pipeline.html
operationId: logstash-get-pipeline
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
additionalProperties:
$ref: '#/components/schemas/logstash._types.Pipeline'
examples:
LogstashGetPipelineResponseExample1:
description: 'A successful response from `GET _logstash/pipeline/my_pipeline`.
'
value: "{\n \"my_pipeline\": {\n \"description\": \"Sample pipeline for illustration purposes\",\n \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n \"pipeline_metadata\": {\n \"type\": \"logstash_pipeline\",\n \"version\": \"1\"\n },\n \"username\": \"elastic\",\n \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n \"pipeline_settings\": {\n \"pipeline.workers\": 1,\n \"pipeline.batch.size\": 125,\n \"pipeline.batch.delay\": 50,\n \"queue.type\": \"memory\",\n \"queue.max_bytes\": \"1gb\",\n \"queue.checkpoint.writes\": 1024\n }\n }\n}"
x-state: Generally available; Added in 7.12.0
x-variations:
- "<div>\n <span class=\"operation-verb get\">GET</span>\n <span class=\"operation-path\">/_logstash/pipeline</span>\n </div>\n "
x-req-auth:
- 'Cluster privileges: `manage_logstash_pipelines`
'
x-api: get_pipeline.logstash
x-category: ingest
x-codeSamples:
- lang: Console
source: 'GET _logstash/pipeline/my_pipeline
'
- lang: Python
source: "resp = client.logstash.get_pipeline(\n id=\"my_pipeline\",\n)"
- lang: JavaScript
source: "const response = await client.logstash.getPipeline({\n id: \"my_pipeline\",\n});"
- lang: Ruby
source: "response = client.logstash.get_pipeline(\n id: \"my_pipeline\"\n)"
- lang: PHP
source: "$resp = $client->logstash()->getPipeline([\n \"id\" => \"my_pipeline\",\n]);"
- lang: curl
source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
- lang: Java
source: "client.logstash().getPipeline(g -> g\n .id(\"my_pipeline\")\n);\n"
x-metaTags:
- content: Elasticsearch, Logstash
name: product_name
components:
schemas:
_types.DateTime:
description: 'A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a
number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string
representation.'
oneOf:
- type: string
- $ref: '#/components/schemas/_types.EpochTimeUnitMillis'
_types.Ids:
oneOf:
- $ref: '#/components/schemas/_types.Id'
- type: array
items:
$ref: '#/components/schemas/_types.Id'
_types.UnitMillis:
description: Time unit for milliseconds
type: number
logstash._types.PipelineMetadata:
type: object
properties:
type:
type: string
version:
type: string
required:
- type
- version
logstash._types.Pipeline:
type: object
properties:
description:
description: 'A description of the pipeline.
This description is not used by Elasticsearch or Logstash.'
type: string
last_modified:
description: 'The date the pipeline was last updated.
It must be in the `yyyy-MM-dd''T''HH:mm:ss.SSSZZ` strict_date_time format.'
allOf:
- $ref: '#/components/schemas/_types.DateTime'
pipeline:
externalDocs:
url: https://www.elastic.co/docs/reference/logstash/configuration-file-structure
description: The configuration for the pipeline.
type: string
pipeline_metadata:
description: 'Optional metadata about the pipeline, which can have any contents.
This metadata is not generated or used by Elasticsearch or Logstash.'
allOf:
- $ref: '#/components/schemas/logstash._types.PipelineMetadata'
pipeline_settings:
externalDocs:
url: https://www.elastic.co/docs/reference/logstash/logstash-settings-file
description: 'Settings for the pipeline.
It supports only flat keys in dot notation.'
allOf:
- $ref: '#/components/schemas/logstash._types.PipelineSettings'
username:
description: The user who last updated the pipeline.
type: string
required:
- description
- last_modified
- pipeline
- pipeline_metadata
- pipeline_settings
- username
logstash._types.PipelineSettings:
type: object
properties:
pipeline.workers:
description: The number of workers that will, in parallel, execute the filter and output stages of the pipeline.
type: number
pipeline.batch.size:
description: The maximum number of events an individual worker thread will collect from inputs before attempting to execute its filters and outputs.
type: number
pipeline.batch.delay:
description: When creating pipeline event batches, how long in milliseconds to wait for each event before dispatching an undersized batch to pipeline workers.
type: number
queue.type:
description: The internal queuing model to use for event buffering.
type: string
queue.max_bytes:
description: 'The total capacity of the queue (`queue.type: persisted`) in number of bytes.'
type: string
queue.checkpoint.writes:
description: 'The maximum number of written events before forcing a checkpoint when persistent queues are enabled (`queue.type: persisted`).'
type: number
required:
- pipeline.workers
- pipeline.batch.size
- pipeline.batch.delay
- queue.type
- queue.max_bytes
- queue.checkpoint.writes
_types.EpochTimeUnitMillis:
allOf:
- $ref: '#/components/schemas/_types.UnitMillis'
_types.Id:
type: string
securitySchemes:
apiKeyAuth:
type: apiKey
in: header
name: Authorization
description: "Elasticsearch APIs support key-based authentication.\nYou must create an API key and use the encoded value in the request header.\nFor example:\n\n```\ncurl -X GET \"${ES_URL}/_cat/indices?v=true\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nTo get API keys, use the `/_security/api_key` APIs."
basicAuth:
type: http
scheme: basic
bearerAuth:
type: http
scheme: bearer
description: 'Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.
For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)'
x-tagGroups:
- name: AI & Machine Learning
tags:
- analytics
- graph
- inference
- ml
- ml anomaly
- ml data frame
- ml trained model
- query_rules
- text_structure
- name: Cluster Management
tags:
- ccr
- cluster
- connector
- data stream
- ilm
- indices
- rollup
- script
- search_application
- searchable_snapshots
- slm
- snapshot
- name: Data Processing
tags:
- enrich
- fleet
- ingest
- logstash
- synonyms
- transform
- name: Information & Monitoring
tags:
- cat
- features
- health_report
- info
- license
- migration
- tasks
- watcher
- xpack
- name: Search & Document APIs
tags:
- document
- eql
- esql
- search
- sql
- name: Security
tags:
- security