﻿---
title: Custom Logs (Deprecated) Package
description: This package is deprecated, please use the Custom Logs (Filestream) package instead. In future releases it's expected to have an automated way to migrate...
url: https://www.elastic.co/docs/reference/integrations/log
---

# Custom Logs (Deprecated) Package


|                                                                                                                                     |                                        |
|-------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------|
| **Version**Version                                                                                                                  | 2.4.4 ([View all](#changelog)View all) |
| **Subscription level**Subscription level[What's this?](https://www.elastic.co/subscriptions)What's this?                            | Basic                                  |
| **Level of support**Level of support[What's this?](https://www.elastic.co/docs/reference/integrations/level-of-support)What's this? | Elastic                                |

**This package is deprecated, please use the Custom Logs (Filestream) package instead.**
<warning>
  Migrating from the "Custom Logs (Deprecated)" to "Custom Logs
  (Filestream)" will cause files to be re-ingested because the state is not migrated.
</warning>

In future releases it's expected to have an automated way to migrate the state. However, this is not possible at the moment.
The current best option for minimizing the data duplication while migrating to "Custom Logs (Filestream)" is to use the 'Ignore Older' or 'Exclude Files' options.
The **Custom Logs** package is used to ingest arbitrary log files and parse their contents using [Ingest Pipelines](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html). Follow the steps below to set up and use this package.

## Get started

1. **Install Elastic Agent**
   Install an [Elastic Agent](https://www.elastic.co/guide/en/fleet/current/install-fleet-managed-elastic-agent.html) on the machine from which you want to collect logs.
2. **Identify the Log Location**
   Identify the log location on that machine, for example, `/tmp/custom.log`.   
   - If you need to include multiple log files or an entire directory, consider using wildcard patterns such as `/tmp/*.log` to capture all `.log` files, or `/tmp/*` to include all file types.
   - Note that the [System integration](https://docs.elastic.co/en/integrations/system) ingests `/var/log/*.log`. You do not need to add this path if the System integration is in use.
3. **Enroll the Custom Logs Integration**   
   - Add the **Custom Logs** integration to your installed Elastic Agent.
   - Provide an Integration name. A descriptive name will make managing this integration in the Kibana UI more intuitive.
   - Configure the path to match the location(s) identified in the previous step.
   - Provide a dataset name that reflects the purpose of your logs (for example, `python` for Python application logs).
4. **Verify Data in Discover**   
   - Open [Discover](https://www.elastic.co/guide/en/kibana/current/discover.html) in Kibana and filter the `logs-*` indices to your dataset name (e.g., `logs-python`) to confirm that the raw log data is being ingested.
5. **Configure Parsing Rules**   
   - Use [Ingest Pipelines](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html) to define parsing rules.
   - See [Parse and route logs](https://www.elastic.co/guide/en/serverless/current/observability-parse-log-data.html) for examples of how to extract structured fields and reroute log data to specific data streams.
6. **Create a Custom Dashboard**   
   - Use [Kibana](https://www.elastic.co/guide/en/kibana/current/create-a-dashboard-of-panels-with-web-server-data.html) to build a dashboard for analyzing incoming log data based on your specific needs.


## ECS Field Mapping

This integration includes an ECS Dynamic Template, so any fields following the [ECS](https://www.elastic.co/guide/en/ecs/current/index.html) schema will automatically receive the correct index field mappings without additional manual configuration.

## Changelog

<dropdown title="Changelog">


  | Version        | Details                                                                                                                                                                                                  | Kibana version(s)              |
  |----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
  | **2.4.4**2.4.4 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/13679)View pull request)Rename from Legacy to Deprecated                                                    | 8.8.0 or higher9.0.0 or higher |
  | **2.4.3**2.4.3 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/13670)View pull request)Add warning about migration from "Custom Logs (Legacy)" to"Custom Logs (Filestream" | 8.8.0 or higher9.0.0 or higher |
  | **2.4.2**2.4.2 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/13664)View pull request)Rename the integration package                                                      | 8.8.0 or higher9.0.0 or higher |
  | **2.4.1**2.4.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/13663)View pull request)Allow deprecated mode for 9.0.0+ stacks                                             | 8.8.0 or higher9.0.0 or higher |
  | **2.4.0**2.4.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/13123)View pull request)Allow to be installed on 9.0.0+ stacks                                              | 8.8.0 or higher9.0.0 or higher |
  | **2.3.3**2.3.3 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/12222)View pull request)Update documentation                                                                | 8.8.0 or higher                |
  | **2.3.2**2.3.2 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/11181)View pull request)Update package spec to V3                                                           | 8.8.0 or higher                |
  | **2.3.1**2.3.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/9386)View pull request)Enhance description of custom option                                                 | 8.8.0 or higher                |
  | **2.3.0**2.3.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/7940)View pull request)Expose exclude_files option                                                          | 8.8.0 or higher                |
  | **2.2.0**2.2.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/7615)View pull request)Expose ignore_older option                                                           | 8.8.0 or higher                |
  | **2.1.0**2.1.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/6570)View pull request)Add mapping for message field                                                        | 8.8.0 or higher                |
  | **2.0.0**2.0.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/5347)View pull request)Change from type "integration" to "input"                                            | 8.8.0 or higher                |
  | **1.1.2**1.1.2 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/5123)View pull request)Added categories and/or subcategories.                                               |                                |
  | **1.1.1**1.1.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/5153)View pull request)Improve documentation                                                                |                                |
  | **1.1.0**1.1.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/4568)View pull request)Add custom logs and processors                                                       |                                |
  | **1.0.0**1.0.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/2538)View pull request)Release Custom Logs as GA                                                            |                                |
  | **0.5.1**0.5.1 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/2059)View pull request)Uniform with guidelines                                                              |                                |
  | **0.5.0**0.5.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/1364)View pull request)Update integration description                                                       |                                |
  | **0.4.6**0.4.6 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/integrations/pull/766)View pull request)Updating package owner                                                                |                                |
  | **0.1.0**0.1.0 | **Enhancement**Enhancement ([View pull request](https://github.com/elastic/package-storage/pull/30)View pull request)initial release                                                                     |                                |
</dropdown>
