How to configure a Logstash stdout output

Printing events to stdout is the quickest truth serum for a Logstash pipeline when fields or filters do not behave as expected. A readable event dump makes it easier to debug parsing, enrichment, and conditional routing before any data is sent to an external destination.

A Logstash pipeline processes events through inputs, optional filters, and outputs, and the stdout output plugin writes each processed event to the process standard output stream. The configured codec (such as rubydebug or json_lines) controls how events are serialized, which affects readability and log volume.

When Logstash runs as a systemd service, standard output is captured by the journal, so event payloads become part of system logs. Event content may include secrets or personal data and can expand quickly under load, so stdout output is best kept temporary and scoped with a tag or conditional output whenever possible.

Steps to configure a Logstash stdout output:

Create a test input file owned by the logstash user at /var/lib/logstash/stdout-test.log.

$ sudo install --owner=logstash --group=logstash --mode=0644 /dev/null /var/lib/logstash/stdout-test.log

Create a pipeline configuration file at /etc/logstash/conf.d/50-stdout-output.conf.

input {
  file {
    path => "/var/lib/logstash/stdout-test.log"
    start_position => "end"
    sincedb_path => "/var/lib/logstash/sincedb-stdout-test"
    tags => [ "stdout_debug" ]
  }
}
output {
  if "stdout_debug" in [tags] {
    stdout {
      codec => rubydebug
    }
  }
}

Tagging events as stdout_debug keeps stdout output scoped to the test input.

Test the pipeline configuration.

$ sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash --config.test_and_exit
Using bundled JDK: /usr/share/logstash/jdk
##### snipped #####
Configuration OK
[2026-01-07T04:48:31,326][INFO ][logstash.runner          ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

Restart the Logstash service.
```
$ sudo systemctl restart logstash
```
Related: How to manage the Logstash service with systemctl in Linux

Append a test event line to /var/lib/logstash/stdout-test.log.

$ echo "stdout output test" | sudo tee -a /var/lib/logstash/stdout-test.log >/dev/null

Review the Logstash journal for the new stdout event output.

$ sudo journalctl --unit=logstash --no-pager --since "1 minute ago"
Jan 07 04:50:32 host logstash[12684]: {
Jan 07 04:50:32 host logstash[12684]:          "@version" => "1",
Jan 07 04:50:32 host logstash[12684]:     "ingest_source" => "beats",
Jan 07 04:50:32 host logstash[12684]:               "log" => {
Jan 07 04:50:32 host logstash[12684]:         "file" => {
Jan 07 04:50:32 host logstash[12684]:             "path" => "/var/lib/logstash/stdout-test.log"
Jan 07 04:50:32 host logstash[12684]:         }
Jan 07 04:50:32 host logstash[12684]:     },
Jan 07 04:50:32 host logstash[12684]:        "@timestamp" => 2026-01-07T04:50:32.188701634Z,
Jan 07 04:50:32 host logstash[12684]:             "event" => {
Jan 07 04:50:32 host logstash[12684]:         "original" => "stdout output test"
Jan 07 04:50:32 host logstash[12684]:     },
Jan 07 04:50:32 host logstash[12684]:           "message" => "stdout output test",
Jan 07 04:50:32 host logstash[12684]:              "host" => {
Jan 07 04:50:32 host logstash[12684]:         "name" => "0.0.0.0"
Jan 07 04:50:32 host logstash[12684]:     },
Jan 07 04:50:32 host logstash[12684]:              "tags" => [
Jan 07 04:50:32 host logstash[12684]:         [0] "stdout_debug"
Jan 07 04:50:32 host logstash[12684]:     ]
Jan 07 04:50:32 host logstash[12684]: }

Use journalctl --unit=logstash --follow to stream events while troubleshooting.

Leaving stdout output enabled can expose full event content in the journal and rapidly increase log size.