LogstashClient

Client for the Kibana Logstash Configuration Management API.

Manage centrally-managed Logstash pipelines that are stored in Elasticsearch and distributed to Logstash instances configured with xpack.management (centralized pipeline management). A running Logstash instance is not required to create, read, update, or delete pipeline definitions.

Note

All endpoints in this namespace are in technical preview in Kibana 9.4 and are not space-scoped.

Required privileges: the logstash_admin built-in role (or a customized Logstash writer role) for write operations, and the logstash_admin built-in role (or a customized Logstash reader role) for read operations.

class kibana._sync.client.logstash.LogstashClient(client, default_space_id=None, validate_spaces=True)[source]

Bases: NamespaceClient

Client for the Kibana Logstash Configuration Management API.

Manage centrally-managed Logstash pipelines that are stored in Elasticsearch and distributed to Logstash instances configured with xpack.management (centralized pipeline management). A running Logstash instance is not required to create, read, update, or delete pipeline definitions.

All endpoints in this namespace are in Technical Preview in Kibana 9.4 and are not space-scoped.

Required privileges: the logstash_admin built-in role (or a customized Logstash writer role) for write operations, and the logstash_admin built-in role (or a customized Logstash reader role) for read operations.

Example

>>> from kibana import Kibana
>>> client = Kibana("http://localhost:5601", api_key="...")
>>>
>>> # Create a pipeline
>>> client.logstash.create_or_update(
...     id="hello-world",
...     pipeline="input { stdin {} } output { stdout {} }",
...     description="Just a simple pipeline",
... )
>>>
>>> # List all pipelines
>>> for p in client.logstash.get_all().body["pipelines"]:
...     print(p["id"])
hello-world

Managing Pipelines

from kibana import Kibana

client = Kibana("http://localhost:5601", api_key="your_api_key")

# Create (or replace) a pipeline
client.logstash.create_or_update(
    id="hello-world",
    pipeline="input { stdin {} } output { stdout {} }",
    description="Just a simple pipeline",
)

# List all pipelines
for p in client.logstash.get_all().body["pipelines"]:
    print(p["id"])

# Get a single pipeline (includes the pipeline definition)
pipeline = client.logstash.get(id="hello-world")
print(pipeline.body["pipeline"])

# Delete the pipeline
client.logstash.delete(id="hello-world")

Pipeline Settings

Pipelines accept optional Logstash settings (worker counts, batch sizes, queue configuration):

client.logstash.create_or_update(
    id="tuned-pipeline",
    pipeline="input { stdin {} } output { stdout {} }",
    settings={
        "pipeline.workers": 2,
        "pipeline.batch.size": 250,
        "queue.type": "persisted",
    },
)
get_all()[source]

Get all Logstash pipelines.

Get a list of all centrally-managed Logstash pipelines. Limit the number of pipelines to 10,000 or fewer; as the number of pipelines nears and surpasses 10,000, you may see performance issues on Kibana. The username property appears in the response when security is enabled and depends on when the pipeline was created or last updated.

Technical preview in 9.4.

Returns:

ObjectApiResponse with a pipelines list; each entry contains id, description, last_modified and, when security is enabled, username.

Raises:
Return type:

ObjectApiResponse[Any]

Example

>>> response = client.logstash.get_all()
>>> for pipeline in response.body["pipelines"]:
...     print(pipeline["id"], pipeline.get("description", ""))
hello-world Just a simple pipeline
get(*, id)[source]

Get a Logstash pipeline.

Get information for a centrally-managed Logstash pipeline.

Technical preview in 9.4.

Parameters:

id (str) – An identifier for the pipeline.

Returns:

id, description, pipeline (the pipeline definition), settings and, when security is enabled, username.

Return type:

ObjectApiResponse with the pipeline document

Raises:

Example

>>> response = client.logstash.get(id="hello-world")
>>> print(response.body["pipeline"])
input { stdin {} } output { stdout {} }
create_or_update(*, id, pipeline, description=None, settings=None)[source]

Create or update a Logstash pipeline.

Create a centrally-managed Logstash pipeline or update an existing pipeline (the operation is an upsert on id).

Technical preview in 9.4.

Parameters:

  • id (str) – An identifier for the pipeline. It must begin with a letter or underscore and can contain only letters, underscores, dashes, hyphens, and numbers.

  • pipeline (str) – A definition for the pipeline, as a Logstash pipeline configuration string.

  • description (str | None) – A description of the pipeline.

  • settings (dict[str, Any] | None) – Supported settings, represented as object keys, include pipeline.workers, pipeline.batch.size, pipeline.batch.delay, pipeline.ecs_compatibility, pipeline.ordered, queue.type, queue.max_bytes and queue.checkpoint.writes.

Returns:

ObjectApiResponse with an empty body (the server replies 204 No Content on success).

Raises:
Return type:

ObjectApiResponse[Any]

Example

>>> client.logstash.create_or_update(
...     id="hello-world",
...     pipeline="input { stdin {} } output { stdout {} }",
...     description="Just a simple pipeline",
...     settings={"queue.type": "persisted"},
... )
delete(*, id)[source]

Delete a Logstash pipeline.

Delete a centrally-managed Logstash pipeline.

Technical preview in 9.4.

Parameters:

id (str) – An identifier for the pipeline.

Returns:

ObjectApiResponse with an empty body (the server replies 204 No Content on success).

Raises:
Return type:

ObjectApiResponse[Any]

Example

>>> client.logstash.delete(id="hello-world")
__init__(client, default_space_id=None, validate_spaces=True)

Initialize NamespaceClient with optional space support.

Parameters:

  • client (BaseClient) – Parent BaseClient instance to delegate requests to

  • default_space_id (str | None) – Optional default space ID for all operations

  • validate_spaces (bool) – Whether to validate space existence (default: True)

perform_request(method, path, *, params=None, headers=None, body=None)

Perform an HTTP request via the parent client with space context enhancement.

Parameters:

  • method (str) – HTTP method (GET, POST, PUT, DELETE, etc.)

  • path (str) – API endpoint path

  • params (dict[str, Any] | None) – Query parameters

  • headers (dict[str, str] | None) – Request headers

  • body (dict[str, Any] | None) – Request body

Returns:

API response

Raises:

ApiError – If the API returns an error response (enhanced with space context)

Return type:

ObjectApiResponse[Any]

AsyncLogstashClient

Asynchronous version of the LogstashClient for use with async/await syntax.

class kibana._async.client.logstash.AsyncLogstashClient(client, default_space_id=None, validate_spaces=True)[source]

Bases: AsyncNamespaceClient

Async client for the Kibana Logstash Configuration Management API.

Manage centrally-managed Logstash pipelines that are stored in Elasticsearch and distributed to Logstash instances configured with xpack.management (centralized pipeline management). A running Logstash instance is not required to create, read, update, or delete pipeline definitions.

All endpoints in this namespace are in Technical Preview in Kibana 9.4 and are not space-scoped.

Required privileges: the logstash_admin built-in role (or a customized Logstash writer role) for write operations, and the logstash_admin built-in role (or a customized Logstash reader role) for read operations.

Example

>>> from kibana import AsyncKibana
>>> client = AsyncKibana("http://localhost:5601", api_key="...")
>>>
>>> # Create a pipeline
>>> await client.logstash.create_or_update(
...     id="hello-world",
...     pipeline="input { stdin {} } output { stdout {} }",
...     description="Just a simple pipeline",
... )
>>>
>>> # List all pipelines
>>> for p in (await client.logstash.get_all()).body["pipelines"]:
...     print(p["id"])
hello-world

Usage

The AsyncLogstashClient provides the same methods as LogstashClient but all methods are async and must be awaited:

from kibana import AsyncKibana
import asyncio

async def main():
    async with AsyncKibana("http://localhost:5601") as client:
        # Create a pipeline (async)
        await client.logstash.create_or_update(
            id="async-pipeline",
            pipeline="input { stdin {} } output { stdout {} }",
        )

        # List pipelines (async)
        pipelines = await client.logstash.get_all()

        # Delete (async)
        await client.logstash.delete(id="async-pipeline")

asyncio.run(main())
async get_all()[source]

Get all Logstash pipelines.

Get a list of all centrally-managed Logstash pipelines. Limit the number of pipelines to 10,000 or fewer; as the number of pipelines nears and surpasses 10,000, you may see performance issues on Kibana. The username property appears in the response when security is enabled and depends on when the pipeline was created or last updated.

Technical preview in 9.4.

Returns:

ObjectApiResponse with a pipelines list; each entry contains id, description, last_modified and, when security is enabled, username.

Raises:
Return type:

ObjectApiResponse[Any]

Example

>>> response = await client.logstash.get_all()
>>> for pipeline in response.body["pipelines"]:
...     print(pipeline["id"], pipeline.get("description", ""))
hello-world Just a simple pipeline
async get(*, id)[source]

Get a Logstash pipeline.

Get information for a centrally-managed Logstash pipeline.

Technical preview in 9.4.

Parameters:

id (str) – An identifier for the pipeline.

Returns:

id, description, pipeline (the pipeline definition), settings and, when security is enabled, username.

Return type:

ObjectApiResponse with the pipeline document

Raises:

Example

>>> response = await client.logstash.get(id="hello-world")
>>> print(response.body["pipeline"])
input { stdin {} } output { stdout {} }
async create_or_update(*, id, pipeline, description=None, settings=None)[source]

Create or update a Logstash pipeline.

Create a centrally-managed Logstash pipeline or update an existing pipeline (the operation is an upsert on id).

Technical preview in 9.4.

Parameters:

  • id (str) – An identifier for the pipeline. It must begin with a letter or underscore and can contain only letters, underscores, dashes, hyphens, and numbers.

  • pipeline (str) – A definition for the pipeline, as a Logstash pipeline configuration string.

  • description (str | None) – A description of the pipeline.

  • settings (dict[str, Any] | None) – Supported settings, represented as object keys, include pipeline.workers, pipeline.batch.size, pipeline.batch.delay, pipeline.ecs_compatibility, pipeline.ordered, queue.type, queue.max_bytes and queue.checkpoint.writes.

Returns:

ObjectApiResponse with an empty body (the server replies 204 No Content on success).

Raises:
Return type:

ObjectApiResponse[Any]

Example

>>> await client.logstash.create_or_update(
...     id="hello-world",
...     pipeline="input { stdin {} } output { stdout {} }",
...     description="Just a simple pipeline",
...     settings={"queue.type": "persisted"},
... )
async delete(*, id)[source]

Delete a Logstash pipeline.

Delete a centrally-managed Logstash pipeline.

Technical preview in 9.4.

Parameters:

id (str) – An identifier for the pipeline.

Returns:

ObjectApiResponse with an empty body (the server replies 204 No Content on success).

Raises:
Return type:

ObjectApiResponse[Any]

Example

>>> await client.logstash.delete(id="hello-world")
__init__(client, default_space_id=None, validate_spaces=True)

Initialize AsyncNamespaceClient with optional space support.

Parameters:

  • client (AsyncBaseClient) – Parent AsyncBaseClient instance to delegate requests to

  • default_space_id (str | None) – Optional default space ID for all operations

  • validate_spaces (bool) – Whether to validate space existence (default: True)

async perform_request(method, path, *, params=None, headers=None, body=None)

Perform an async HTTP request via the parent client with space context enhancement.

Parameters:

  • method (str) – HTTP method (GET, POST, PUT, DELETE, etc.)

  • path (str) – API endpoint path

  • params (dict[str, Any] | None) – Query parameters

  • headers (dict[str, str] | None) – Request headers

  • body (dict[str, Any] | None) – Request body

Returns:

API response

Raises:

ApiError – If the API returns an error response (enhanced with space context)

Return type:

ObjectApiResponse[Any]