> ## Documentation Index
> Fetch the complete documentation index at: https://docs.honeycomb.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Logstash

<Badge className="hny-badge-enterprise-addon" stroke>Ent+</Badge>

<Note>
  This feature is available as an add-on for the [Honeycomb Enterprise plan](https://www.honeycomb.io/pricing/).
  Please contact your Honeycomb account team for details.
</Note>

## Supported Platforms

| Platform | Metrics | Logs | Traces |
| :------- | :------ | :--- | :----- |
| Linux    |         | ✓    |        |
| Windows  |         | ✓    |        |
| macOS    |         | ✓    |        |

## Configuration Table

| Parameter                       | Type       | Default                  | Description                                                                                                                                                                                                                                          |
| :------------------------------ | :--------- | :----------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| listen\_port\*                  | `int`      | 2255                     | Port to listen on.                                                                                                                                                                                                                                   |
| listen\_ip                      | `string`   | "0.0.0.0"                | IP Address to listen on.                                                                                                                                                                                                                             |
| log\_type                       | `string`   | logstash                 | Arbitrary for attribute 'log\_type'. Useful for filtering between many logstash sources.                                                                                                                                                             |
| parse\_format                   | `enum`     | none                     | Method to use when parsing. Valid values are `none`, `json`, and `regex`. When regex is selected, 'Regex Pattern' must be set.                                                                                                                       |
| regex\_pattern                  | `string`   |                          | The regex pattern used when parsing log entries.                                                                                                                                                                                                     |
| multiline\_line\_start\_pattern | `string`   |                          | Regex pattern that matches the beginning of a log entry, for handling multiline logs.                                                                                                                                                                |
| multiline\_line\_end\_pattern   | `string`   |                          | Regex pattern that matches the end of a log entry, useful for terminating parsing of multiline logs.                                                                                                                                                 |
| parse\_timestamp                | `bool`     | false                    | Whether to parse the timestamp from the log entry.                                                                                                                                                                                                   |
| timestamp\_field                | `string`   | timestamp                | The field containing the timestamp in the log entry.                                                                                                                                                                                                 |
| parse\_timestamp\_format        | `enum`     | ISO8601                  | The format of the timestamp in the log entry. Choose a common format, or specify a custom format. Options include "ISO8601", "RFC3339", "Epoch", and "Manual".                                                                                       |
| epoch\_timestamp\_format        | `enum`     | s                        | The layout of the epoch-based timestamp. Required when parse\_timestamp\_format is set to "Epoch".. Options include "s", "ms", "us", "ns", "s.ms", "s.us", "s.ns".                                                                                   |
| manual\_timestamp\_format       | `string`   | '%Y-%m-%dT%H:%M:%S.%f%z' | The strptime layout of the timestamp. Used when parse\_timestamp\_format is set to "Manual".                                                                                                                                                         |
| timezone                        | `timezone` | UTC                      | The timezone to use if the Timestamp Format doesn't include a timezone. Otherwise, the timezone in the Timestamp Format will be respected. **NOTE: This is also required to parse timezone abbreviations, due to their ambiguity.**                  |
| parse\_severity                 | `bool`     | false                    | Whether to parse severity from the log entry.                                                                                                                                                                                                        |
| severity\_field                 | `string`   | severity                 | The field containing the severity in the log entry.                                                                                                                                                                                                  |
| parse\_to                       | `string`   | body                     | The [field](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/stanza/docs/types/field.md) that the log will be parsed to. Some exporters handle logs favorably when parsed to `attributes` over `body` and vice versa. |
| preserve\_original              | `bool`     | false                    | When this option is set to true, the original event will be preserved under the attributes                                                                                                                                                           |
| enable\_tls                     | `bool`     | false                    | Whether or not to use TLS.                                                                                                                                                                                                                           |
| tls\_certificate\_path          | `string`   |                          | Path to the TLS cert to use for TLS-required connections.                                                                                                                                                                                            |
| tls\_private\_key\_path         | `string`   |                          | Path to the TLS key to use for TLS-required connections.                                                                                                                                                                                             |
| tls\_min\_version               | `enum`     | "1.2"                    | The minimum TLS version to support. 1.0 and 1.1 should not be considered secure. Valid values include: `1.3`, `1.2`, `1.1`, `1.0`.                                                                                                                   |