:plugin: logstash
:type: integration
:no_codec:

///////////////////////////////////////////
START - GENERATED VARIABLES, DO NOT EDIT!
///////////////////////////////////////////
:version: %VERSION%
:release_date: %RELEASE_DATE%
:changelog_url: %CHANGELOG_URL%
:include_path: ../../../../logstash/docs/include
///////////////////////////////////////////
END - GENERATED VARIABLES, DO NOT EDIT!
///////////////////////////////////////////

[id="plugins-{type}s-{plugin}"]

=== Logstash Integration Plugin

include::{include_path}/plugin_header.asciidoc[]

==== Description

The Logstash Integration Plugin provides integrated plugins for sending events from one Logstash to another instance(s):

* {logstash-ref}/plugins-outputs-logstash.html[Logstash output plugin]
* {logstash-ref}/plugins-inputs-logstash.html[Logstash input plugin]

[id="plugins-{type}s-{plugin}-concepts"]
===== High-level concepts

You can configure a `logstash` output to send events to one or more `logstash` inputs, which are each in another pipeline that is running in different processes or on a different host.

To do so, you should first configure the downstream pipeline with a `logstash` input plugin, bound to an available port so that it can listen for inbound connections.
Security is enabled by default, so you will need to either provide identity material or disable SSL.

NOTE: You will need a TCP route from the upstream pipeline to the interface that the downstream pipeline is bound to.

[source]
----
input {
  logstash {
    port => 9800

    # SSL IDENTITY <1>
    ssl_keystore_path      => "/path/to/identity.p12"
    ssl_keystore_password  => "${SSL_IDENTITY_PASSWORD}"
  }
}
----
<1> Identity material typically should include identity claims about the hostnames and ip addresses that will be used by upstream output plugins.

Once the downstream pipeline is configured and running, you may send events from any number of upstream pipelines by adding a `logstash` output plugin that points to the downstream input.
You may need to configure SSL to trust the certificates presented by the downstream input plugin.

[source]
----
output {
  logstash {
    hosts => ["10.0.0.123:9800", "10.0.0.125:9801"]

    # SSL TRUST <1>
    ssl_truststore_path => "/path/to/truststore.p12"
    ssl_truststore_password => "${SSL_TRUST_PASSWORD}"
  }
}
----
<1> Unless SSL is disabled or the downstream input is expected to present certificates signed by globally-trusted authorities, you will likely need to provide a source-of-trust.

[id="plugins-{type}s-{plugin}-load-balancing"]
==== Load Balancing

When a `logstash` output is configured to send to multiple `hosts`, it distributes events in batches to _all_ of those downstream hosts fairly, favoring those without recent errors. This increases the likelihood of each batch being routed to a downstream that is up and has capacity to receive events.

:no_codec!:
