> For the complete documentation index, see [llms.txt](https://hezhiqiang.gitbook.io/elkstack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hezhiqiang.gitbook.io/elkstack/logstash/performance/jian-kong-fang-an/api.md).

# API方式

Logstash 5.0 开始，提供了输出自身进程的指标和状态监控的 API。这大大降低了我们监控 Logstash 的难度。

目前 API 主要有四类：

* 节点信息
* 插件信息
* 节点指标
* 热线程统计

## 节点信息

node info 接口目前支持三种类型：pipeline、os、jvm。没什么要紧的。

## 插件信息

用来列出已安装插件的名称和版本。

## 节点指标

node stats 接口目前支持四种类型的指标：

### events

获取该指标的方式为：

```
curl -s localhost:9600/_node/stats/events?pretty=true
```

是的，Logstash 跟 Elasticsearch 一样也支持用 `?pretty` 参数美化 JSON 输出。此外，还支持 `?format=yaml` 来输出 YAML 格式的指标统计。Logstash 默认监听在 9600 端口提供这些 API 访问。如果需要修改，通过 `--http.port` 命令行参数，或者对应的 `logstash.yml` 设置修改。

该指标的响应结果示例如下：

```javascript
{
    "events" : {
        "in" : 59685,
        "filtered" : 59685,
        "out" : 59685
    }
}
```

### jvm

获取该指标的方式为：

```
curl -s localhost:9600/_node/stats/jvm?pretty=true
```

该指标的响应结果示例如下：

```
{
    "jvm" : {
        "threads" : {
            "count" : 32,
            "peak_count" : 34
        }
    }
}
```

### process

获取该指标的方式为：

```
curl -s localhost:9600/_node/stats/process?pretty=true
```

该指标的响应结果示例如下：

```
{
    "process" : {
            "peak_open_file_descriptors" : 64,
            "max_file_descriptors" : 10240,
            "open_file_descriptors" : 64,
        "mem" : {
            "total_virtual_in_bytes" : 5278068736
        },
        "cpu" : {
            "total_in_millis" : 103290097000,
            "percent" : 0
        }
    }
}
```

目前 beats 家族有个 [logstashbeat](https://github.com/consulthys/logstashbeat) 项目，就是专门采集这个数据的。

### pipeline

获取该指标的方式为：

```
curl -s localhost:9600/_node/stats/pipeline?pretty=true
```

该指标的响应结果示例如下：

```javascript
{
    "pipeline": {
        "events": {
            "duration_in_millis": 7863504,
            "in": 100,
            "filtered": 100,
            "out": 100
        },
        "plugins": {
            "inputs": [],
            "filters": [
                {
                    "id": "grok_20e5cb7f7c9e712ef9750edf94aefb465e3e361b-2",
                    "events": {
                        "duration_in_millis": 48,
                        "in": 100,
                        "out": 100
                    },
                    "matches": 100,
                    "patterns_per_field": {
                        "message": 1
                    },
                    "name": "grok"
                },
                {
                    "id": "geoip_20e5cb7f7c9e712ef9750edf94aefb465e3e361b-3",
                    "events": {
                        "duration_in_millis": 141,
                        "in": 100,
                        "out": 100
                    },
                    "name": "geoip"
                }
            ],
            "outputs": [
                {
                    "id": "20e5cb7f7c9e712ef9750edf94aefb465e3e361b-4",
                    "events": {
                        "in": 100,
                        "out": 100
                    },
                    "name": "elasticsearch"
                }
            ]
        },
        "reloads": {
            "last_error": null,
            "successes": 0,
            "last_success_timestamp": null,
            "last_failure_timestamp": null,
            "failures": 0
        }
    }
}
```

可以看到它这里显示了每个插件的日志处理情况(数量、耗时等)，尤其是 grok 过滤器插件，还显示出来了正则匹配失败的数量、每个字段匹配的正则表达式个数等很有用的排障和性能调优信息。

## 热线程统计

上面的指标值可能比较适合的是长期趋势的监控，在排障的时候，更需要的是即时的线程情况统计。获取方式如下：

```
curl -s localhost:9600/_node/stats/hot_threads?human=true
```

该接口默认返回也是 JSON 格式，在看堆栈的时候并不方便，可以用 `?human=true` 参数来改成文本换行的样式。效果上跟我们看 Elasticsearch 的 `/_nodes/_local/hot_threads` 效果就一样了。

其实节点指标 API 也有 `?human=true` 参数，其作用和 `hot_threads` 不一样，是把一些网络字节数啊，时间啊，改成人类更易懂的大单位。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hezhiqiang.gitbook.io/elkstack/logstash/performance/jian-kong-fang-an/api.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.