Skip to content
Osuite Osuite Docs

Forward logs from Logstash to Osuite

Overview

Section titled “Overview”

If you already run Logstash, route its output to Osuite through an OpenTelemetry Collector. Logstash has no first-party OTLP output, so both paths below send to a local Collector, which exports to Osuite with the otlp/osuite exporter.

Prerequisites

Section titled “Prerequisites”
  • A running Logstash instance with inputs and filters already configured.
  • An OpenTelemetry Collector reachable from Logstash.
  • Your Osuite ingest endpoint and token.

OpenTelemetry output plugin

Section titled “OpenTelemetry output plugin”

Install the plugin and point it at a local Collector’s OTLP endpoint:

bin/logstash-plugin install logstash-output-opentelemetry
output {
  opentelemetry {
    endpoint => "127.0.0.1:4317"
    protocol => "grpc"
    compression => "gzip"
  }
}

Collector:

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317


processors:
  batch:


exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>


service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [batch]
      exporters: [otlp/osuite]

The plugin maps the message field to the log body; use its body, severity_text, trace_id, and span_id options to map other fields.

Alternative: TCP output with JSON

Section titled “Alternative: TCP output with JSON”

To avoid the community plugin, emit JSON lines over TCP and parse them at the Collector’s tcplog receiver.

Logstash:

output {
  tcp {
    host => "<your-collector-host>"
    port => 5514
    codec => json_lines
  }
}

Collector:

receivers:
  tcplog:
    listen_address: 0.0.0.0:5514
    operators:
      - type: json_parser
        severity:
          parse_from: attributes.level


processors:
  batch:


exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>


service:
  pipelines:
    logs:
      receivers: [tcplog]
      processors: [batch]
      exporters: [otlp/osuite]

The json_parser operator turns each line into structured attributes; point its severity.parse_from at the field that holds the level.

Verify in Osuite

Section titled “Verify in Osuite”

What you should see

Logstash events appear in the Logs Explorer within a minute, carrying the fields your Logstash filters produced as attributes.

Troubleshooting

Section titled “Troubleshooting”

If nothing arrives, confirm Logstash reaches the Collector (port 4317 for OTLP/gRPC, 5514 for TCP) and that the matching receiver is wired into the logs pipeline. On the TCP path, a parse failure means the codec is not json_lines or the json_parser field paths do not match. Check the Collector logs for OTLP export errors to Osuite.

No data in Osuite after a few minutes? Work through these checks.

  • Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
  • Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
  • Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
  • Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
  • Network — confirm the host has outbound access to the ingest endpoint on port 443.
  • Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.

Next steps

Section titled “Next steps”