CIOPages
For vendorsCorrections to your listing are free
Fix an error, free List a company, free Order a Spotlight listingAbout Spotlight listings
DirectoryObservability & MonitoringLog Management & AnalyticsLogstash

Logstash

About Logstash

Logstash is a server-side data processing pipeline. It ingests data regardless of format or complexity and transforms it. It provides a persistent queue to guarantee at-least-once delivery of events. It includes monitoring and pipeline viewer features to observe deployments. It offers a Pipeline Management UI for centrally managing deployments.

Products

  • Logstash: Open source server-side data processing pipeline that ingests, transforms, and sends data to a chosen destination.
  • Pipeline Viewer: Feature used to observe and study an active Logstash node or deployment.
  • Pipeline Management UI: Interface for orchestrating and managing Logstash pipelines.

Used for

  • Deriving structure from unstructured data with grok.
  • Deciphering geo coordinates from IP addresses.
  • Anonymizing or excluding sensitive fields.
  • Ingesting data from logs, metrics, web applications, data stores, and various AWS services.
  • Parsing and ingesting CSV files into Elasticsearch.

From Logstash's own website, read 2026-10-24. How we build listings.

How to evaluate Log Management & Analytics

This is how the CIOPages Research Team evaluates this category. It is not an assessment of Logstash. It comes from our Log Management & Analysis buyer guide.

25%
Cost & Tiering Model at Volume
Unit of pricing (per-GB ingest, compute/SVC, credits, host, consumption) and how the bill behaves as volume grows; hot/warm/cold/frozen or archive tiers, index-free or low-cost retention tiers, rehydration cost and latency, and ingest controls or sampling to cap spend
20%
Search, Query & Analytics Power
Full-text vs. label-only vs. schema-on-read; query language depth (SPL, ES|QL/KQL, LogQL, DQL, SQL) and learning curve; performance on cold and high-cardinality data; aggregations, pattern detection, and live-tail for real-time troubleshooting
20%
Pipeline, Ingestion & OpenTelemetry
Agent footprint and collector strategy; native OpenTelemetry/OTLP ingest; parsing, enrichment, masking, routing, and reduction before storage; ability to fan data out to multiple destinations and to swap backends without re-instrumenting sources
15%
Security, Compliance & Retention
RBAC/SSO, field-level masking of sensitive data, immutable/WORM audit retention, and tamper-evident logging; SOC 2 / ISO 27001 / FedRAMP coverage and data residency; SIEM or threat-detection content if logs feed security
10%
Observability Correlation & Architecture
Whether logs sit standalone, inside an observability suite (correlated with metrics and traces), or inside the SIEM; trace-to-log pivots, unified context, and how cleanly it slots beside tooling you already run
10%
Operations, Scale & AI Assist
Self-managed vs. SaaS operational burden, multi-tenant and multi-cluster scale, ingest spikes and back-pressure handling; API/IaC coverage; and AI-assisted features such as anomaly detection, log clustering/patterns, and natural-language query

CIOPages put this listing together from public sources. It’s information, not an endorsement. How we build listings. Work here? Claim this listing or .

Quick Facts

www.elastic.co/logstash
CategoryObservability & Monitoring
SubcategoryLog Management & Analytics
PricingOpen source

We publish a detail only when we can point at the page it came from. Know when Logstash was founded or where it is based? Send it to us, free.

Keep reading

Buyer Guide
Log Management & Analysis
State of Play
LLM observability

The annual review of this market: what changed, with answers from the vendors in it.

RFP questions
Cloud data warehouse RFP questions

The questions to put to warehouse vendors, ready to paste into an RFP.