Logstash is an open source data extract-transform-load (ETL) tool packaged with many plugins. Its role in the Elastic Stack is as a server-side generic data collector and processor. Logstash provides the capability to receive data from multiple inputs, apply a multitude of filters to the inputs, and output them to multiple types of sources simultaneously. Logstash operates in three stages for event aggregation and processing: collection, processing, and dispatching. The collection stage consists of inputs that generate events; processing consists of filters for modifying those events; and dispatching sends the events elsewhere as output.
Figure 4. Logstash