Logstash Output Plugin for OpenTelemetry

This is a Java-based plugin for Logstash.

It is fully free and fully open source. The license is Apache 2.0, meaning you are free to use it however you want.

OpenTelemetry

This plugin allows Logstash to output looks to an OpenTelemetry otlp endpoint.

Default field mapping is as per the spec: https://opentelemetry.io/docs/reference/specification/logs/data-model/#elastic-common-schema

@timestamp >> Timestamp
message >> Body

All other fields are attached as Attributes.

Installation

For some reason the following does NOT work.

logstash-plugin install logstash-output-opentelemetry

Instead, manually install the Gem:

curl -LO https://rubygems.org/downloads/logstash-output-opentelemetry-0.2.5.gem
logstash-plugin install --no-verify --local *gem

Usage

input {
    generator {
        count => 10
        add_field => {
            "log.level" => "WARN"
        }
    }
}
output {
    opentelemetry {
        endpoint => "http://otel:4317"
        protocol => "grpc"
        compression => "none"
    }
}

Options

Setting	Input Type	Required
endpoint	uri	Yes
endpoint_type	string	No (Deprecated)
protocol	string, one of ["grpc", "http"]	No
compression	string, one of ["gzip", "none"]	No
resource	Hash	No
body	Field Reference	No
name	Field Reference	No
severity_text	Field Reference	No
trace_id	Field Reference	No
span_id	Field Reference	No
trace_flags	Field Reference	No

endpoint

• This is a required setting.
• There is no default value for this setting.
• Value type is uri

An endpoint that supports otlp to which logs are sent.

endpoint_type

• Deprecated. Replaced with protocol.

protocol

• Value type is string
• Default is: grpc

Possible values are grpc or http

compression

• Value type is string
• Default is: none

Possible values are gzip or none

resource

• Value type is hash
• Default is empty

This hash allows additional fields to be added to the OpenTelemetry Resource field Hash values must be strings.

body

• Value type is Field Reference
• Default is message

The field to reference as the Otel Body field.

severity_text

• Value type is Field Reference

The field to reference as the Otel Severity Text field.

trace_id

• Value type is Field Reference

The field to reference as the Otel Trace ID field.

span_id

• Value type is Field Reference

The field to reference as the Otel Span ID field.

trace_flags

• Value type is Field Reference

The field to reference as the Otel Trace Flags field.

Building

make gem

Running locally

docker-compose up

Notes

Warning This plugin depends on OpenTelemetry logging libraries are that are alpha quality.