> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install and configure Logstash

> Install and configure Logstash to send logs to Gcore Managed Logging using Kafka output and the Kafka Integration Plugin.

Logstash is an open-source data collection and processing tool. It's used to collect, parse, enrich, and transform log data from various sources, including log files, event streams, and databases.

## Install Logstash

Download Logstash from the [official Elastic website](https://www.elastic.co/logstash) and install it per the instructions.

## Configure Logstash

A standard Logstash configuration consists of three sections: `input`, `filter`, and `output`. The `input` and `filter` sections depend on the sources of logs.

To send logs to Gcore Managed Logging, configure Logstash with Kafka output and enable the [Kafka Integration Plugin](https://github.com/logstash-plugins/logstash-integration-kafka) in your Logstash installation.

1\. Configure Logstash with Kafka output by adding the following data to the `logstash.conf` file:

```
output {
        kafka {
          codec => json
          topic_id => "yourlogin.yourtopic"
          bootstrap_servers => "endpoint"
          sasl_mechanism => "SCRAM-SHA-512"
          security_protocol => "SASL_SSL"
          sasl_jaas_config => "org.apache.kafka.common.security.scram.ScramLoginModule required username='yourlogin'password='yourpassword'; "
          key_serializer => "org.apache.kafka.common.serialization.StringSerializer"
          value_serializer => "org.apache.kafka.common.serialization.StringSerializer"
        }
    }
```

2\. Customize the highlighted values:

* **yourlogin.yourtopic**: Username from the **Managed Logging** page and topic name, separated by a dot (.)
* **endpoint**: Kafka endpoint — find this on the **Managed Logging** page in the Gcore Customer Portal
* **yourlogin**: Username from the **Managed Logging** page
* **yourpassword**: Password from the **Managed Logging** page

> [!TIP]
>
> Username, password, and topic name are available in the Gcore Customer Portal on the **Managed Logging** page. For configuration details, see [Configure logging and view logs](/cloud/logging-as-a-service/configure-logging-and-view-your-logs).

For more settings, check out the [Kafka output plugin](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-kafka.html) documentation.

> **Descriptions of the 'output' parameters**
>
> * **topic\_id**: ID of the Kafka topic to which Logstash will publish messages.
> * **bootstrap\_servers**: A comma-separated list of Kafka broker addresses.
> * **sasl\_mechanism**: Authentication mechanism used to verify the username and password for the logs storage.
> * **security\_protocol**: Security protocol used to encrypt data in transit.
> * **sasl\_jaas\_config**: JAAS configuration required for SASL authentication.
> * **key\_serializer**: Serialization format used to convert message keys sent to Kafka.
> * **value\_serializer**: Serialization method applied to message content before transmission to Kafka.

3\. Save the changes in the Logstash configuration file.

4\. Restart Logstash. Logstash will start sending logs to Gcore Managed Logging.