Elastic Stack (ELK Stack) Logstash API

The logstash API from Elastic Stack (ELK Stack) — 4 operation(s) for logstash.

Documentation GitHub OpenAPI

Operations 8

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /_logstash/pipeline/{id} Get a Logstash pipeline from Elasticsearch · Get Logstash pipelines #

Ask an LLM

“Can I read a centrally managed Logstash pipeline straight from the Elasticsearch _logstash API?”

“What config and settings does a given pipeline have in Elasticsearch central management?”

Tell an agent

Get Logstash pipeline {id} from the Elasticsearch _logstash endpoint.

Fetch pipelines {id} through Elasticsearch, not Kibana.

PUT /_logstash/pipeline/{id} Store a Logstash pipeline in Elasticsearch · Create or update a Logstash pipeline #

Ask an LLM

“What fields does the Elasticsearch _logstash API require to save a pipeline, like username and last_modified?”

“Will writing a pipeline through Elasticsearch replace one with the same ID?”

Tell an agent

Save Logstash pipeline {id} in Elasticsearch with config {pipeline}, edited by {username}.

Replace pipeline {id} via the _logstash API with settings {pipeline_settings}.

DELETE /_logstash/pipeline/{id} Delete a Logstash pipeline from Elasticsearch · Delete a Logstash pipeline #

Ask an LLM

“Can I delete a centrally managed pipeline directly through the Elasticsearch _logstash API?”

“What does Elasticsearch return after it removes a Logstash pipeline?”

Tell an agent destructive · confirm first

Delete Logstash pipeline {id} through the Elasticsearch _logstash API.

Remove pipeline {id} from Elasticsearch central management storage.

GET /_logstash/pipeline List Logstash pipelines in Elasticsearch · Get Logstash pipelines #

Ask an LLM

“Which Logstash pipelines are stored in Elasticsearch for central management?”

“Can I get every centrally managed pipeline from the _logstash API in one call?”

Tell an agent

List all Logstash pipelines stored in Elasticsearch.

Get every pipeline from the Elasticsearch _logstash endpoint.

DELETE /api/logstash/pipeline/{id} Delete a Logstash pipeline in Kibana · Delete a Logstash pipeline #

Ask an LLM

“How do I remove a centrally managed pipeline using Kibana?”

“Which Kibana role lets me delete a Logstash pipeline?”

Tell an agent destructive · confirm first

Delete Logstash pipeline {id} via Kibana.

Remove the Kibana-managed pipeline {id}.

GET /api/logstash/pipeline/{id} Get a Logstash pipeline from Kibana · Get a Logstash pipeline #

Ask an LLM

“How do I view a centrally managed Logstash pipeline through the Kibana API?”

“What role do I need to read a pipeline in Kibana's Logstash management?”

Tell an agent

Show Logstash pipeline {id} from Kibana.

Get the Kibana-managed pipeline {id} and its settings.

PUT /api/logstash/pipeline/{id} Create or update a Logstash pipeline in Kibana · Create or update a Logstash pipeline #

Ask an LLM

“How do I create a centrally managed Logstash pipeline from Kibana?”

“Can I change the batch size or workers of a pipeline through Kibana's settings field?”

Tell an agent

Create or update Kibana pipeline {id} with config {pipeline}.

Set Kibana Logstash pipeline {id} to settings {settings} and description {description}.

GET /api/logstash/pipelines List all Logstash pipelines in Kibana · Get all Logstash pipelines #

Ask an LLM

“What Logstash pipelines does Kibana central management know about?”

“Is there a limit to how many pipelines I should keep before listing slows down?”

Tell an agent

List all Logstash pipelines managed in Kibana.

Show every centrally managed pipeline from the Kibana API.

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-logstash-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Elk Stack Logstash API
  version: ''
  x-refined-note:
  - x-doc-license differs across the merged source definitions and was not carried
  - x-feedbackLink differs across the merged source definitions and was not carried
  description: 'Operations tagged logstash across 2 of this provider''s published API definitions: elk-stack-elasticsearch-openapi.json, elk-stack-kibana-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
tags:
- name: logstash
paths:
  /_logstash/pipeline/{id}:
    get:
      tags:
      - logstash
      summary: Get Logstash pipelines
      description: 'Get pipelines that are used for Logstash Central Management.


        ## Required authorization


        * Cluster privileges: `manage_logstash_pipelines`'
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-get-pipeline.html
      operationId: logstash-get-pipeline-1
      parameters:
      - $ref: '#/components/parameters/logstash.get_pipeline-id'
      responses:
        '200':
          $ref: '#/components/responses/logstash.get_pipeline-200'
      x-state: Generally available; Added in 7.12.0
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
    put:
      tags:
      - logstash
      summary: Create or update a Logstash pipeline
      description: 'Create a pipeline that is used for Logstash Central Management.

        If the specified pipeline exists, it is replaced.


        ## Required authorization


        * Cluster privileges: `manage_logstash_pipelines`'
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-put-pipeline.html
      operationId: logstash-put-pipeline
      parameters:
      - in: path
        name: id
        description: 'An identifier for the pipeline.

          Pipeline IDs must begin with a letter or underscore and contain only letters, underscores, dashes, hyphens and numbers.'
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/logstash._types.Pipeline'
            examples:
              LogstashPutPipelineRequestExample1:
                summary: Create a pipeline
                description: Run `PUT _logstash/pipeline/my_pipeline` to create a pipeline.
                value: "{\n  \"description\": \"Sample pipeline for illustration purposes\",\n  \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n  \"pipeline_metadata\": {\n    \"type\": \"logstash_pipeline\",\n    \"version\": 1\n  },\n  \"username\": \"elastic\",\n  \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n  \"pipeline_settings\": {\n    \"pipeline.workers\": 1,\n    \"pipeline.batch.size\": 125,\n    \"pipeline.batch.delay\": 50,\n    \"queue.type\": \"memory\",\n    \"queue.max_bytes\": \"1gb\",\n    \"queue.checkpoint.writes\": 1024\n  }\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json: {}
      x-state: Generally available; Added in 7.12.0
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
    delete:
      tags:
      - logstash
      summary: Delete a Logstash pipeline
      description: 'Delete a pipeline that is used for Logstash Central Management.

        If the request succeeds, you receive an empty response with an appropriate status code.


        ## Required authorization


        * Cluster privileges: `manage_logstash_pipelines`'
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-delete-pipeline.html
      operationId: logstash-delete-pipeline
      parameters:
      - in: path
        name: id
        description: An identifier for the pipeline.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json: {}
      x-state: Generally available; Added in 7.12.0
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
  /_logstash/pipeline:
    get:
      tags:
      - logstash
      summary: Get Logstash pipelines
      description: 'Get pipelines that are used for Logstash Central Management.


        ## Required authorization


        * Cluster privileges: `manage_logstash_pipelines`'
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-get-pipeline.html
      operationId: logstash-get-pipeline
      responses:
        '200':
          $ref: '#/components/responses/logstash.get_pipeline-200'
      x-state: Generally available; Added in 7.12.0
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
  /api/logstash/pipeline/{id}:
    delete:
      description: 'Delete a centrally-managed Logstash pipeline.

        If your Elasticsearch cluster is protected with basic authentication, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.'
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: delete-logstash-pipeline
      parameters:
      - description: An identifier for the pipeline.
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Indicates a successful call
      summary: Delete a Logstash pipeline
      tags:
      - logstash
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    get:
      description: 'Get information for a centrally-managed Logstash pipeline.

        To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.'
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: get-logstash-pipeline
      parameters:
      - description: An identifier for the pipeline.
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getLogstashPipelineResponseExample1:
                  value: "{\n  \"id\": \"hello-world\",\n  \"description\": \"Just a simple pipeline\",\n  \"username\": \"elastic\",\n  \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n  \"settings\": {\n    \"queue.type\": \"persistent\"\n  }\n}"
              schema:
                type: object
          description: Indicates a successful call
      summary: Get a Logstash pipeline
      tags:
      - logstash
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    put:
      description: 'Create a centrally-managed Logstash pipeline or update a pipeline.

        To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.'
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: put-logstash-pipeline
      parameters:
      - description: 'An identifier for the pipeline. Pipeline ID must begin with a letter or underscore and can contain only letters, underscores, dashes, hyphens, and numbers.

          '
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              putLogstashPipelineRequestExample1:
                value: "{\n  \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n  \"settings\": {\n    \"queue.type\": \"persisted\"\n  }\n}"
            schema:
              type: object
              properties:
                description:
                  description: A description of the pipeline.
                  maxLength: 1024
                  type: string
                pipeline:
                  description: A definition for the pipeline.
                  type: string
                settings:
                  description: 'Supported settings, represented as object keys, include the following:


                    - `pipeline.workers`

                    - `pipeline.batch.size`

                    - `pipeline.batch.delay`

                    - `pipeline.ecs_compatibility`

                    - `pipeline.ordered`

                    - `queue.type`

                    - `queue.max_bytes`

                    - `queue.checkpoint.writes`

                    '
                  type: object
              required:
              - pipeline
      responses:
        '204':
          description: Indicates a successful call
      summary: Create or update a Logstash pipeline
      tags:
      - logstash
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
  /api/logstash/pipelines:
    get:
      description: 'Get a list of all centrally-managed Logstash pipelines.


        To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.

        > info

        > Limit the number of pipelines to 10,000 or fewer. As the number of pipelines nears and surpasses 10,000, you may see performance issues on Kibana.


        The `username` property appears in the response when security is enabled and depends on when the pipeline was created or last updated.'
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: get-logstash-pipelines
      responses:
        '200':
          content:
            application/json:
              examples:
                getLogstashPipelinesResponseExample1:
                  value: "{\n  \"pipelines\": [\n    {\n      \"id\": \"hello-world\",\n      \"description\": \"Just a simple pipeline\",\n      \"last_modified\": \"2018-04-14T12:23:29.772Z\",\n      \"username\": \"elastic\" \n    },\n    {\n      \"id\": \"sleepy-pipeline\",\n      \"description\": \"\",\n      \"last_modified\": \"2018-03-24T03:41:30.554Z\"\n    }\n  ]\n}"
              schema:
                type: object
          description: Indicates a successful call
      summary: Get all Logstash pipelines
      tags:
      - logstash
      x-state: Technical Preview
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
components:
  parameters:
    logstash.get_pipeline-id:
      in: path
      name: id
      description: A comma-separated list of pipeline identifiers.
      required: true
      deprecated: false
      schema:
        $ref: '#/components/schemas/_types.Ids'
      style: simple
  schemas:
    _types.Id:
      type: string
    _types.UnitMillis:
      description: Time unit for milliseconds
      type: number
    _types.Ids:
      oneOf:
      - $ref: '#/components/schemas/_types.Id'
      - type: array
        items:
          $ref: '#/components/schemas/_types.Id'
    logstash._types.Pipeline:
      type: object
      properties:
        description:
          description: 'A description of the pipeline.

            This description is not used by Elasticsearch or Logstash.'
          type: string
        last_modified:
          description: 'The date the pipeline was last updated.

            It must be in the `yyyy-MM-dd''T''HH:mm:ss.SSSZZ` strict_date_time format.'
          allOf:
          - $ref: '#/components/schemas/_types.DateTime'
        pipeline:
          externalDocs:
            url: https://www.elastic.co/docs/reference/logstash/configuration-file-structure
          description: The configuration for the pipeline.
          type: string
        pipeline_metadata:
          description: 'Optional metadata about the pipeline, which can have any contents.

            This metadata is not generated or used by Elasticsearch or Logstash.'
          allOf:
          - $ref: '#/components/schemas/logstash._types.PipelineMetadata'
        pipeline_settings:
          externalDocs:
            url: https://www.elastic.co/docs/reference/logstash/logstash-settings-file
          description: 'Settings for the pipeline.

            It supports only flat keys in dot notation.'
          allOf:
          - $ref: '#/components/schemas/logstash._types.PipelineSettings'
        username:
          description: The user who last updated the pipeline.
          type: string
      required:
      - description
      - last_modified
      - pipeline
      - pipeline_metadata
      - pipeline_settings
      - username
    _types.DateTime:
      description: 'A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a

        number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string

        representation.'
      oneOf:
      - type: string
      - $ref: '#/components/schemas/_types.EpochTimeUnitMillis'
    logstash._types.PipelineMetadata:
      type: object
      properties:
        type:
          type: string
        version:
          type: string
      required:
      - type
      - version
    _types.EpochTimeUnitMillis:
      allOf:
      - $ref: '#/components/schemas/_types.UnitMillis'
    logstash._types.PipelineSettings:
      type: object
      properties:
        pipeline.workers:
          description: The number of workers that will, in parallel, execute the filter and output stages of the pipeline.
          type: number
        pipeline.batch.size:
          description: The maximum number of events an individual worker thread will collect from inputs before attempting to execute its filters and outputs.
          type: number
        pipeline.batch.delay:
          description: When creating pipeline event batches, how long in milliseconds to wait for each event before dispatching an undersized batch to pipeline workers.
          type: number
        queue.type:
          description: The internal queuing model to use for event buffering.
          type: string
        queue.max_bytes:
          description: 'The total capacity of the queue (`queue.type: persisted`) in number of bytes.'
          type: string
        queue.checkpoint.writes:
          description: 'The maximum number of written events before forcing a checkpoint when persistent queues are enabled (`queue.type: persisted`).'
          type: number
      required:
      - pipeline.workers
      - pipeline.batch.size
      - pipeline.batch.delay
      - queue.type
      - queue.max_bytes
      - queue.checkpoint.writes
  responses:
    logstash.get_pipeline-200:
      description: ''
      content:
        application/json:
          schema:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/logstash._types.Pipeline'
          examples:
            LogstashGetPipelineResponseExample1:
              description: 'A successful response from `GET _logstash/pipeline/my_pipeline`.

                '
              value: "{\n  \"my_pipeline\": {\n    \"description\": \"Sample pipeline for illustration purposes\",\n    \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n    \"pipeline_metadata\": {\n      \"type\": \"logstash_pipeline\",\n      \"version\": \"1\"\n    },\n    \"username\": \"elastic\",\n    \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n    \"pipeline_settings\": {\n      \"pipeline.workers\": 1,\n      \"pipeline.batch.size\": 125,\n      \"pipeline.batch.delay\": 50,\n      \"queue.type\": \"memory\",\n      \"queue.max_bytes\": \"1gb\",\n      \"queue.checkpoint.writes\": 1024\n    }\n  }\n}"
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-refined-from:
- elk-stack-elasticsearch-openapi.json
- elk-stack-kibana-openapi.yaml
x-elastic:
  curl:
    auth: '-H "Authorization: ApiKey $ECE_API_KEY"'

Elastic Stack (ELK Stack) Logstash API

Operations 8

Documentation

Specifications

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification