New Relic Logstash Output Plugin

This is a plugin for Logstash that outputs logs to New Relic.

Installation

Install the New Relic Logstash plugin using the following command:
logstash-plugin install logstash-output-newrelic

Versions

Versions of this plugin less than 1.0.0 are unsupported.

Configuration

Add the following block to your logstash.conf (with your specific API Insert key), then restart Logstash. There are other optional configuration properties, see below.

Get your API Insert Key: https://insights.newrelic.com/accounts/<ACCOUNT_ID>/manage/api_keys

Example:

output {
  newrelic {
    api_key => "<API_INSERT_KEY>"
  }
}

Required plugin configuration

Property	Description
api_key	your New Relic API Insert key

Optional plugin configuration

Property	Description	Default value
concurrent_requests	The number of threads to make requests from	1
base_uri	New Relic ingestion endpoint	https://log-api.newrelic.com/log/v1

EU plugin configuration

When using this plugin in the EU override the base_uri with http://log-api.eu.newrelic.com/log/v1

Testing

An easy way to test the plugin is to make sure Logstash is getting input from a log file you can write to. Something like this in your logstash.conf:

input {
  file {
    path => "/path/to/your/log/file"
  }
}

• Restart Logstash
• Append a test log message to your log file: echo "test message" >> /path/to/your/log/file
• Search New Relic Logs for "test message"

JSON message parsing

This plugin will attempt to parse any 'message' attribute as JSON -- if it is JSON, it will be parsed and the JSON attributes will be added to the event.

For example, the event:

{
  "timestamp": 1562767499238,
  "message": "{\"service-name\": \"login-service\", \"user\": {\"id\": 123, \"name\": \"alice\"}}"
}

Will be treated as:

{
  "timestamp": 1562767499238,
  "message": "{\"service-name\": \"my-service\", \"user\": {\"id\": 123, \"name\": \"alice\"}}",
  "service-name": "login-service",
  "user": {
    "id": 123,
    "name": "alice"
  }
}