How to install Logstash plugins

Installing additional plugins expands Logstash with new inputs, filters, codecs, and outputs for data sources that are not covered by the default distribution. Keeping required plugins installed across environments prevents pipelines from failing at startup due to missing components and keeps deployments predictable.

Plugins are managed with the logstash-plugin utility, which installs Ruby gems into Logstash’s bundled JRuby environment and registers them for use by pipeline configurations. On packaged installations, the plugin manager is typically available at /usr/share/logstash/bin/logstash-plugin.

Plugin installation requires write access to the Logstash installation tree and often downloads additional dependencies, so network access and proxy settings can affect the install. A service restart is required for Logstash to load newly installed plugins, which pauses ingestion while pipelines reload and should be planned accordingly on production systems.

1. Review the currently installed plugins.

   $ sudo /usr/share/logstash/bin/logstash-plugin list | head -n 5
   Using bundled JDK: /usr/share/logstash/jdk
   logstash-codec-avro
   logstash-codec-cef
   logstash-codec-collectd
   logstash-codec-dots
   logstash-codec-edn

2. Install the required plugin.

   $ sudo /usr/share/logstash/bin/logstash-plugin install logstash-filter-translate
   Using bundled JDK: /usr/share/logstash/jdk
   Validating logstash-filter-translate
   Resolving mixin dependencies
   Updating mixin dependencies logstash-mixin-ecs_compatibility_support, logstash-mixin-validator_support, logstash-mixin-deprecation_logger_support, logstash-mixin-scheduler
   Bundler attempted to update logstash-mixin-ecs_compatibility_support but its version stayed the same
   Bundler attempted to update logstash-mixin-validator_support but its version stayed the same
   Bundler attempted to update logstash-mixin-deprecation_logger_support but its version stayed the same
   Bundler attempted to update logstash-mixin-scheduler but its version stayed the same
   Installing logstash-filter-translate
   Installation successful

   Plugin installation can take several minutes when dependencies are downloaded and built.

3. Confirm the plugin is available.

   $ sudo /usr/share/logstash/bin/logstash-plugin list | grep translate
   Using bundled JDK: /usr/share/logstash/jdk
   logstash-filter-translate

4. Test the pipeline configuration for syntax errors.

   $ sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --path.data /tmp/logstash-configtest --config.test_and_exit
   Using bundled JDK: /usr/share/logstash/jdk
   Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
   Configuration OK
   Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

   Related: How to test a Logstash pipeline configuration

5. Restart the Logstash service to load the plugin.

   $ sudo systemctl restart logstash

   Restarting Logstash stops running pipelines and can interrupt ingestion until the service is fully started.

   Related: How to manage the Logstash service with systemctl in Linux

6. Verify the Logstash service is running after the restart.

   $ sudo systemctl status logstash --no-pager -n 12
   ● logstash.service - logstash
        Loaded: loaded (/usr/lib/systemd/system/logstash.service; enabled; preset: enabled)
        Active: active (running) since Wed 2026-01-07 22:23:13 UTC; 5s ago
      Main PID: 36165 (java)
         Tasks: 31 (limit: 28486)
        Memory: 554.4M (peak: 555.1M)
           CPU: 20.032s
   ##### snipped #####