Skip to main content

Elastic

The Elastic backend is ingest-only. Delivery is selected via a transport config field so one backend type can support multiple Elastic ingest paths over time.

Transports​

filebeat (default)​

Sends events to a Filebeat HTTP input endpoint.

See Filebeat HTTP input configuration for details on setting up the input server.

Configuration

  • transport: (string) "filebeat" (default when omitted — preserves existing backends)
  • url: (string, required) a valid HTTP(S) endpoint
  • username: (string, optional) used for basic auth
  • password: (string, optional) used for basic auth

Implementation is based on the webhook backend.

otlp​

Exports logs via OTLP HTTP/protobuf — the same delivery path as the OTLP adaptor. Use this for Elastic managed OTLP ingest (e.g. Supabase log drains).

Configuration

  • transport: (string, required) "otlp"
  • endpoint: (string, required) OTLP HTTP endpoint, e.g. https://abc.ingest.us-central1.gcp.elastic.cloud:443/supabase/v1/logs
  • protocol: (string) fixed to "http/protobuf" for now
  • gzip: (boolean) enables gzip compression; defaults to true
  • headers: (map) additional HTTP headers (auth, content-type, etc.)

logstash​

Sends events to a Logstash http input as a JSON array. Use this to route Logflare events through an existing Logstash pipeline — for filtering, enrichment, or fan-out to Elasticsearch and beyond.

Configuration

  • transport: (string, required) "logstash"
  • url: (string, required) the Logstash HTTP(S) input endpoint, e.g. http://logstash.internal:8080
  • username: (string, optional) used for basic auth; maps to the input's user option
  • password: (string, optional) used for basic auth
  • gzip: (boolean) enables gzip compression; defaults to true
  • headers: (map) additional HTTP headers

Payload

Unlike the filebeat transport, which forwards event bodies as-is, this transport reshapes each event into an ECS-flavoured document. timestamp becomes the ECS @timestamp (ISO8601) and event_message becomes message, so no date filter is required on the Logstash side. Remaining fields stay at the top level and Logflare metadata is namespaced under logflare:

[
  {
    "@timestamp": "2026-09-07T10:00:00.000000Z",
    "message": "hello logstash",
    "my_field": "abc",
    "logflare": {
      "id": "9b0b1d3e-...",
      "source": "my-source",
      "source_uuid": "3d2f...",
      "event_type": "log"
    }
  }
]

If an event has no timestamp, its Logflare ingest time is used instead.

Logstash pipeline

The input must use the json codec so that the JSON array is split into one event per element:

input {
  http {
    port => 8080
    codec => json
    # user => "logflare"
    # password => "changeme"
  }
}

output {
  elasticsearch {
    hosts => ["https://elasticsearch:9200"]
    index => "logflare-%{+YYYY.MM.dd}"
  }
}

Implementation is based on the webhook backend.