---
title: Logstash plugin for log forwarding
source: https://docs.newrelic.com/docs/logs/forward-logs/logstash-plugin-log-forwarding
---

If your log data is already being monitored by [Logstash](https://www.elastic.co/products/logstash), you can use our Logstash plugin to forward and enrich your log data in New Relic.

Forwarding your Logstash logs to New Relic will give you enhanced log management capabilities to collect, process, explore, query, and alert on your log data.

## Enable Logstash for log management [#enable-process]

To forward your logs from Logstash to New Relic:

1.  Make sure you have:

    -   A New Relic license key
    -   [Logstash version 6.6 or higher](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html) with Java 8 or Java 11. Use the [official Oracle distribution](http://www.oracle.com/technetwork/java/javase/downloads/index.html) or an open-source distribution such as [OpenJDK](http://openjdk.java.net/).

2.  [Install and configure](#logstash-plugin) the Logstash plugin.

3.  Optional: Configure [additional plugin attributes](#instrument-plugin).

4.  [Test](#test-plugin) the Logstash plugin.

5.  Generate some traffic and wait a few minutes, then [check your account](#find-data) for data.

## Install and configure the Logstash plugin [#logstash-plugin]

To forward your logs to New Relic with our [Logstash plugin](https://github.com/newrelic/logstash-output-plugin):

1.  Enter the following command into your terminal or command line interface:
    ```bash
    logstash-plugin install logstash-output-newrelic
    ```

2.  In your `logstash.conf` file, add the following block of data. Be sure to replace the placeholder text with your New Relic license key.
    ```ini
    output {
      newrelic {
        license_key => "LICENSE_KEY"
      }
    }
    ```

3.  Restart your Logstash instance.

## Optional configuration [#instrument-plugin]

After you install and configure the Logstash plugin, you can use the following attributes to configure how the plugin sends data to New Relic. For more information on adding or configuring attributes, see our [Logstash configuration examples in GitHub](https://github.com/newrelic/logstash-examples/blob/master/README.md#example-configurations-for-logstash).

| Property              | Description                                                                                                                                                                                                        |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `concurrent_requests` | The number of threads to make requests from. Default: `1`                                                                                                                                                          |
| `base_uri`            | The New Relic ingestion endpoint. - US endpoint (default): `https://log-api.newrelic.com/log/v1` - EU endpoint: `https://log-api.eu.newrelic.com/log/v1` - Japan endpoint: `https://log-api.jp.nr-data.net/log/v1` |
| `max_retries`         | Maximum number attempts to retry to send a message. If set to `0`, no re-attempts will be made. Default: `3`                                                                                                       |

## Test the Logstash plugin [#test-plugin]

To test if your Logstash plugin is receiving input from a log file:

1.  Add the following to your `logstash.conf` file:

    ```ini
    input {
      file {
        path => "/PATH/TO/YOUR/LOG/FILE"
      }
    }
    ```

2.  Restart your Logstash instance.

3.  Run the following command to append a test log message to your log file:

    ```bash
    echo "test message" >> /PATH/TO/YOUR/LOG/FILE
    ```

4.  Search our [logs UI](https://one.newrelic.com/launcher/logger.log-launcher) for `test message`.

## View log data [#find-data]

If everything is configured correctly and your data is being collected, you should see log data in both of these places:

-   Our [logs UI](https://one.newrelic.com/launcher/logger.log-launcher)
-   Our tools for running [NRQL queries](https://docs.newrelic.com/docs/chart-builder/use-chart-builder/choose-data/use-advanced-nrql-mode-specify-data). For example, you can execute a query like this:

```sql
SELECT * FROM Log
```

If no data appears after you enable our log management capabilities, follow our [standard log troubleshooting procedures](https://docs.newrelic.com/docs/logs/log-management/troubleshooting/no-log-data-appears-ui/).

## What's next? [#what-next]

Explore logging data across your platform with our [logs UI](https://docs.newrelic.com/docs/logs/log-management/ui-data/use-logs-ui/).

-   Get deeper visibility into both your application and your platform performance data by forwarding your logs with our [logs in context](https://docs.newrelic.com/docs/logs/enable-log-management-new-relic/configure-logs-context/configure-logs-context-apm-agents/) capabilities.
-   Set up [alerts](https://docs.newrelic.com/docs/alerts-applied-intelligence/new-relic-alerts/alert-conditions/create-alert-conditions/).
-   [Query your data](https://docs.newrelic.com/docs/query-your-data/explore-query-data/get-started/introduction-querying-new-relic-data/) and [create dashboards](https://docs.newrelic.com/docs/query-your-data/explore-query-data/dashboards/introduction-dashboards/).

## Disable log forwarding [#disable]

To disable log forwarding capabilities, follow standard procedures in [Logstash documentation](https://www.elastic.co/products/logstash). You do not need to do anything else in New Relic.