OpenSearchCon Europe 2025

OpenSearch Data Prepper is a pipeline tool within the OpenSearch project for data ingestion. A common question that comes up within the open-source community is how it relates to Logstash. While both tools are open-source and designed to collect, transform, and route data from various sources to destinations, they differ significantly in their features and target use cases.

Logstash, a mature platform with a vast plugin ecosystem, provides flexible and extensive customization options. Data Prepper is a newer offering initially designed for modern observability needs, such as handling OpenTelemetry (OTel) logs, traces, and metrics. Over time, it has evolved into a general-purpose tool capable of interfacing with numerous open-source and proprietary solutions.

In this presentation, we will explore the architectural differences between Data Prepper and Logstash. We’ll also conduct a comparison of their core features, emphasizing Data Prepper's unique capabilities that enable integration with tools such as OpenTelemetry, OpenSearch, Kafka, S3, DynamoDB, and Kinesis. Finally, we'll provide practical guidance and examples to facilitate a smooth migration from Logstash to Data Prepper.