Docs
From version 5.0 onward, Watcher is part of X-Pack. For more information, see Alerting on cluster and index events in the X-Pack Reference.
Elasticsearch Watcher [2.4] » Administering Watcher » Integrating Watcher with Logstash
«  Integrating Watcher with Shield     Configuring the Default Throttle Period  »

Integrating Watcher with Logstash

You can use the webhook action to send data to Logstash so you can transform and enrich watch payloads. Integrating with Logstash also enables you to send watches to any of the outputs supported by Logstash.

To enable Logstash to receive data from Watcher, you need to configure an http input in your Logstash configuration file:

input {
  http {
    host => "mylogstashhost" 
    port => "8080" 
  }
}

The name of your Logstash HTTP host.

The port the HTTP host listens on.

The http input launches a webserver and listens for incoming requests. The Logstash http input supports basic auth and HTTPS.

Note

The http input is built into Logstash 1.5.2 and above. To use the http input with earlier versions of Logstash, install the logstash-input-http plugin by running bin/plugin install logstash-input-http.

«  Integrating Watcher with Shield     Configuring the Default Throttle Period  »