Coralogix provides seamless integration with Logstash, so you can send your logs from anywhere and parse them according to your needs.

## Prerequisites

- Logstash [installed](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html)

## Best Practices

We **recommend** using the generic http output plugin with this integration, given its high level of configurability and metric support for monitoring output.

## Installation

**STEP 1**. Share the Ruby code snippet depicting the event structure as it flows through Logstash.

- [Optional] Use this opportunity to set dynamic application and subsystem fields.
- The example below adopts a JSON structure and has these fields: application, subsystem and host.

```groovy
filter {
  ruby {code => "
                event.set('[@metadata][application]', event.get('application'))
                event.set('[@metadata][subsystem]', event.get('subsystem'))
                event.set('[@metadata][event]', event.to_json)
                event.set('[@metadata][host]', event.get('host'))
                "}
}
```

- If you prefer that the fields application, subsystem and host remain static, replace the `event.get` with a plain string, as in the example below.

```groovy
filter {
  ruby {code => "
                event.set('[@metadata][application]', MyApplicationName)
                event.set('[@metadata][subsystem]', MySubsystemName)
                event.set('[@metadata][event]', event.to_json)
                event.set('[@metadata][host]', event.get('host'))
                "}
}
```

**STEP 2**. Once the Event is ready, configure the output itself to send the logs.

- Input your [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key/index.md).
- Choose the https://ingress.\[[DOMAIN_VALUE]\]/logs/v1/singles endpoint that corresponds to your Coralogix [domain](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain/index.md) using the domain selector at the top of the page.

```groovy
output {
    http {
        url => "https://ingress.[[DOMAIN_VALUE]]/logs/v1/singles"
        http_method => "post"
        headers => ["authorization", "Bearer <Coralogix Send-Your-Data API key>"]
        format => "json_batch"
        codec => "json"
        mapping => {
            "applicationName" => "%{[@metadata][application]}"
            "subsystemName" => "%{[@metadata][subsystem]}"
            "computerName" => "%{[@metadata][host]}"
            "text" => "%{[@metadata][event]}"
        }
        http_compression => true
        automatic_retries => 5
        retry_non_idempotent => true
        connect_timeout => 30
        keepalive => false
        }
}
```

## Additional resources

|                     |                                                                                             |
| ------------------- | ------------------------------------------------------------------------------------------- |
| Coralogix Endpoints | [Coralogix Endpoints](https://coralogix.com/docs/integrations/coralogix-endpoints/index.md) |

## **Support**

**Need help?**

Our world-class customer success team is available 24/7 to walk you through your setup and answer any questions that may come up.

Feel free to reach out to us **via our in-app chat** or by sending us an email at [support@coralogix.com](mailto:support@coralogix.com).