Integrate with Logstash

This article highlights a new alerting feature that's natively available in Jira Service Management which is gradually rolling out to some Jira Service Management Cloud customers. It may not yet be visible or available on your site.

What does the integration offer?

Logstash sends event information via output plugins. With Jira Service Management's Logstash Integration, Jira Service Management acts as a dispatcher for these events, determines the right people to notify based on on-call schedules– notifies via email, text messages (SMS), phone calls, and iPhone & Android push notifications, and escalates alerts until the alert is acknowledged or closed.

How does the integration work?

According to the Logstash events:

Alert is created in Jira Service Management.
Designated alert is acknowledged.
Note is added to designated alert.
Designated alert is closed.

Set up the integration

Logstash is an API-based integration. Setting it up involves the following steps:

Add a Logstash integration in Jira Service Management
Configure the integration in Logstash

Add a Logstash integration

If you're using the Free or Standard plan in Jira Service Management, you can only add this integration from your team’s operations page. To access the feature through Settings (gear icon) > Products (under JIRA SETTINGS) > OPERATIONS, you need to be on Premium or Enterprise plan.

Adding an integration from your team’s operations page makes your team the owner of the integration. This means Jira Service Management only assigns the alerts received through this integration to your team.

To add a Logstash integration in Jira Service Management, complete the following steps:

Go to your team’s operations page.
On the left navigation panel, select Integrations and then Add integration.
Run a search and select “Logstash”.
On the next screen, enter a name for the integration.
Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.
Select Continue.
The integration is saved at this point.
Expand the Steps to configure the integration section and copy the API key.
You will use this key while configuring the integration in Logstash later.
Select Turn on integration.
The rules you create for the integration will work only if you turn on the integration.

Configure the integration in Logstash

To configure the integration of Logstash with Jira Service Management, complete the following steps:

Install the Jira Service Management plugin for Logstash. Find out how to install the plugin.
- Logstash 5.4+: bin/logstash-plugin install logstash-output-jsm
- Other Versions: bin/plugin install logstash-output-jsm
Add the following configuration to the configuration file:
JSON
1 2 3 4 5output { jsm { "apiKey" => "logstash_integration_api_key" } }
Paste the API key copied previously into apiKey.
The Jira Service Management Output plugin expects that events contain a field called "jsmAction". Also, Jira Service Management expects the data in a certain structure, so some additional fields are added to the event. To add fields, use a filter plugin like Mutate, Grok etc. Read more about the fields added to events and what they mean.

Following is an example of a Mutate filter enhanced with Ruby filter plugin configuration:

JSON

filter {
  mutate{
    add_field => {
        "jsmAction" => "create"
        "alias" => "neo123"
        "description" => "Every alert needs a description"
        "actions" => ["Restart", "AnExampleAction"]
    "tags" => ["OverwriteQuietHours","Critical"]
    "[details][prop1]"=> "val1"
        "[details][prop2]" => "val2"
        "entity" => "An example entity"
        "priority" => "P4"
    "source" => "custom source"
    "user" => "custom user"
    "note" => "alert is created"
        }
    }
    ruby {
     code => "event.set('teams', [{'name' => 'Integration'}, {'name' => 'Platform'}])"
    }
}

4. Run Logstash.

Find the plugin’s source on GitHub.

Was this helpful?

It wasn't accurate

It wasn't clear

It wasn't relevant

Jira Service Management Support