Logstash

Receives logs from Elastic Logstash (opens in a new tab) pipelines.

Supported Signal Types

Configuration Options

Send Data to the Collector

Logstash Pipeline

Add a TCP output (opens in a new tab) to your Logstash pipeline, and configure the host and port to send data to the Cardinal Collector's Service URL.

Set the codec to json_lines, and enable Elastic Common Schema (ECS) v8 compatibility, as shown below.

output {
  tcp {
    host => "mycollector.cardinalhq.svc.cluster.local"
    port => 2255
    codec => json_lines {
      ecs_compatibility => v8
    }
  }
}