---
title: Logstash Source
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Observability Pipelines > Sources > Logstash Source
---

# Logstash Source

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ().
{% /alert %}

{% /callout %}
Available for:
{% icon name="icon-logs" /%}
 Logs 
## Overview{% #overview %}

Use Observability Pipelines' Logstash source to receive logs from your Logstash agent.

You can also use the Logstash source to [send logs to Observability Pipelines using Filebeat](https://docs.datadoghq.com/observability_pipelines/sources/filebeat.md).

## Prerequisites{% #prerequisites %}

To use Observability Pipelines' Logstash source, you need the following information available:

- Logstash address, such as `0.0.0.0:8088`. The Observability Pipelines Worker listens on this bind address to receive logs from your applications. Later on, you configure your applications to send logs to this address.
- The appropriate TLS certificates and the password you used to create your private key, if your forwarders are globally configured to enable SSL.

## Setup{% #setup %}

Set up this source when you [set up a pipeline](https://docs.datadoghq.com/observability_pipelines/configuration/set_up_pipelines.md). You can set up a pipeline in the [UI](https://app.datadoghq.com/observability-pipelines), using the [API](https://docs.datadoghq.com/api/latest/observability-pipelines.md), or with [Terraform](https://registry.terraform.io/providers/datadog/datadog/latest/docs/resources/observability_pipeline). The instructions in this section are for setting up the source in the UI.

{% alert level="danger" %}
Only enter the identifiers for the Logstash address and, if applicable, the TLS key pass. Do not enter the actual values.
{% /alert %}

- Enter the identifier for your Logstash address. If you leave it blank, the default is used.

### Optional TLS settings{% #optional-tls-settings %}

Toggle the switch to **Enable TLS**.

- If you are using Secrets Management, enter the identifier for the key pass. See Set secrets for the default used if the field is left blank.
- The following certificate and key files are required:
  - `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  - `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  - `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER, PEM, or CRT (PKCS #8) format.
  - **Notes**:
    - The configuration data directory `/var/lib/observability-pipelines-worker/config/` is automatically appended to the file paths. See [Advanced Worker Configurations](https://docs.datadoghq.com/observability_pipelines/configuration/install_the_worker/advanced_worker_configurations.md) for more information.
    - The file must be readable by the `observability-pipelines-worker` group and user.

## Set secrets{% #set-secrets %}

These are the defaults used for secret identifiers and environment variables.

**Note**: If you enter secret identifiers and then choose to use environment variables, the environment variable is the identifier entered and prepended with `DD_OP`. For example, if you entered `PASSWORD_1` for a password identifier, the environment variable for that password is `DD_OP_PASSWORD_1`.

{% tab title="Secrets Management" %}

- Logstash address identifier:
  - References the address on which the Observability Pipelines Worker listens for incoming log messages.
  - The default identifier is `SOURCE_LOGSTASH_ADDRESS`.
- Logstash TLS passphrase identifier (when TLS is enabled):
  - The default identifier is `SOURCE_LOGSTASH_KEY_PASS`.

{% /tab %}

{% tab title="Environment Variables" %}

- Logstash address and port:
  - The Observability Pipelines Worker listens on this address, such as `0.0.0.0:9997`, for incoming log messages.
  - The default environment variable is `DD_OP_SOURCE_LOGSTASH_ADDRESS`
- Logstash TLS passphrase:
  - The default environment variable is `DD_OP_SOURCE_LOGSTASH_KEY_PASS`.

{% /tab %}

## Send logs to the Observability Pipelines Worker over Logstash{% #send-logs-to-the-observability-pipelines-worker-over-logstash %}

To configure Logstash to send logs to the Observability Pipelines Worker, use the following output configuration:

```
output {
  http {
    url => "http://127.0.0.1:9997"
    http_method => "post"
    format => "json"
  }
}
```

**Note**: Logstash requires SSL to be configured.