# LogStash

Generated on 9 Mar 2026 from [the LogStash catalog page](https://marketplace.digitalocean.com/apps/logstash)

LogStash Droplet 1-Click allows you to create a ready-to-use instance of LogStash in a matter of a minute.

## Software Included

| Package | Version | License |
|---|---|---|
| LogStash | Latest | [Apache License V2 and Elastic License](https://github.com/elastic/logstash/blob/main/LICENSE.txt) |

## Creating an App using the Control Panel

Click the **Deploy to DigitalOcean** button to create a Droplet based on this 1-Click App. If you aren’t logged in, this link will prompt you to log in with your DigitalOcean account.

[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/droplets/new?image=sharklabs-logstash)

## Creating an App using the API

In addition to creating a Droplet from the LogStash 1-Click App using the control panel, you can also use the [DigitalOcean API](https://docs.digitalocean.com/reference/api). As an example, to create a 4GB LogStash Droplet in the SFO2 region, you can use the following `curl` command. You need to either save your [API access token](https://docs.digitalocean.com/reference/api/create-personal-access-token/index.html.md) to an environment variable or substitute it in the command below.

```shell
curl -X POST -H 'Content-Type: application/json' \
         -H 'Authorization: Bearer '$TOKEN'' -d \
        '{"name":"choose_a_name","region":"sfo2","size":"s-2vcpu-4gb","image":"sharklabs-logstash"}' \
        "https://api.digitalocean.com/v2/droplets"
```

## Getting Started After Deploying LogStash

LogStash Droplet 1-Click comes with LogStash installed as an APT package. You can find the LogStash binary here:

```
$ /usr/share/logstash/bin/logstash
```

To run LogStash, you will first need to define it’s configuration. LogStash configuration contains data inputs, mappings and processing, and data outputs. You can read more about this [here](https://www.elastic.co/guide/en/logstash/current/configuration.html).

## Droplet Summary

- UFW firewall allows only SSH (port 22, rate limited)