> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Route logs from Logstash

export const ApiToken = () => <>
    Replace <em><code>API_TOKEN</code></em> with the API token generated from your <a href="/administer/accounts-teams/service-accounts">service account</a>. Chronosphere recommends storing your API token in a separate file or Kubernetes Secret and calling it using an environment variable, such as <code>$API_TOKEN</code>.
  </>;

export const MyTenant = () => <>
    Replace <em><code>TENANT</code></em> with the name of your Observability Platform tenant.
  </>;

You can route log data from Logstash to Chronosphere Observability Platform. To route
logs, configure an
[HTTP output plugin](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html)
in your
[Logstash pipeline configuration file](https://www.elastic.co/guide/en/logstash/current/config-setting-files.html)
that specifies your Observability Platform tenant as a destination.

1. In your Logstash pipeline configuration file, add an `output` section that defines
   the `http` plugin:

   ```text theme={null}
   output {
     http {
        http_method=>"post"
        headers => {
            "Content-Type" => "application/json"
            "API-token" => "API_TOKEN"
        }
        url=>"https://TENANT.chronosphere.io/api/v1/data/logs/ingest"
        format=>"json_batch"
     }
   }
   ```

   * <ApiToken />

     <Note>
       The service account must have read access to route log data to Observability
       Platform.
     </Note>

   * <MyTenant />

   * Optional: The `format=>"json_batch"` option collects each batch of events
     received by the output and places them into a single JSON array that's sent in
     one request.

2. After defining the output, [contact Chronosphere Support](/support) and indicate
   which field in your data contains log timestamps.