Forge Home


Install the logstash agent with a configuration file.


9,978 latest version

3.9 quality score

Version information

  • 0.1.1 (latest)
  • 0.1.0
released Apr 22nd 2013

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'erwbgy-logstash', '0.1.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add erwbgy-logstash
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install erwbgy-logstash --version 0.1.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



erwbgy/logstash — version 0.1.1 Apr 22nd 2013


Install the logstash agent with a configuration file.

To use just:

include logstash

and then specify the location of the config template in hiera - for example:

logstash::config_template: '/etc/puppet/templates/logstash/agent.conf.erb'

Alternatively you call it as a parameterised class:

class { 'logstash':
  config_template => '/etc/puppet/templates/logstash/agent.conf.erb'


Installation assumes that an 'logstash' package is available from the package repository and that the agent configuration file is /etc/logstash/agent.conf. See for pre-built packages for RedHat-like and Debian-like hosts.


See for documentation on logstash configuration.

By default the following template is used to give you a starting point:

input {                                                                 
  tcp {                                                                 
    format => "json_event"                                              
    host => "<%= @fqdn %>"
    port => 5544                                                        
    type => "awesant"                                                   
filter {                                                                
  grok {                                                                
    match => [ "@timestamp", "^%{DATE_EU:date}" ]                       
    type => "awesant"                                                   
output {
  file {
    tags => 'syslog-messages'
    message_format => "%{@message}"
    path => "/var/log/logstash/syslog/messages-%{date}.log"
  file {
    tags => 'syslog-secure'
    message_format => "%{@message}"
    path => "/var/log/logstash/syslog/secure-%{date}.log"

You can use any facter facts in your template - for example 'fqdn' or a custom fact like 'logstash_host'.


License: Apache License, Version 2.0

GitHub URL: