You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit

Custom Logs

Collect custom logs with Elastic Agent.

2.3.0 (View all)
Compatible Kibana version(s)
8.8.0 or higher
Supported Serverless project types

Subscription level

The Custom Logs package is used for ingesting arbitrary log files and manipulating their content/lines by using Ingest Pipelines configuration.

In order to use the package, please follow these steps:

  1. Setup / Install Elastic Agent at the machine where the logs should be collected from
  2. Identify the log location at that machine e.g. /tmp/custom.log. Note that /var/log/*.log is fully ingested by the System, no need to add this path if the System integration is already used
  3. Enroll Custom Logs integration and add it to the installed agent. Give the dataset a name that fits to the log purpose, e.g. python for logs from a Python app. Make sure to configure the path from the step 2
  4. Check that the raw log data is coming in via Discover by filtering the logs-* indices to the dataset name given in step 3, e.g. logs-python
  5. Configure the parsing rules via Ingest Pipelines, e.g. JSON Parsing or grok parsing
  6. Create a custom dashboard that analyzes the incoming log data for your needs

ECS Field Mapping

This integration includes the ECS Dynamic Template, all fields that follows the ECS Schema will get assigned the correct index field mapping and does not need to be added manually.


VersionDetailsKibana version(s)


Enhancement View pull request
Expose exclude_files option

8.8.0 or higher


Enhancement View pull request
Expose ignore_older option

8.8.0 or higher


Enhancement View pull request
Add mapping for message field

8.8.0 or higher


Enhancement View pull request
Change from type "integration" to "input"

8.8.0 or higher


Enhancement View pull request
Added categories and/or subcategories.


Enhancement View pull request
Improve documentation


Enhancement View pull request
Add custom logs and processors


Enhancement View pull request
Release Custom Logs as GA


Enhancement View pull request
Uniform with guidelines


Enhancement View pull request
Update integration description


Enhancement View pull request
Updating package owner


Enhancement View pull request
initial release

On this page