Port 9600 – Elasticsearch / Logstash

TCP

Port 9600 is the Logstash monitoring API port providing pipeline statistics, JVM metrics, and hot threads. Logstash exposes this HTTP API for health monitoring by tools like Metricbeat and Prometheus exporters. No authentication by default – restrict to monitoring infrastructure IPs.

Port Number

9600

Protocol

TCP

Service

Logstash Monitoring API

Range

IANA Registered (1024–49151)

Description

Logstash on port 9600 serves a read-only monitoring API that exposes pipeline throughput (events in/out/filtered per second), JVM heap usage, OS metrics, and pipeline configuration details. The /_node/stats endpoint provides all operational metrics needed for Logstash monitoring. The monitoring API has no authentication mechanism in open-source Logstash. While it is read-only (no configuration changes possible), it reveals pipeline configuration including input/output plugin settings that may contain connection strings or hostnames. Bind to localhost (api.http.host: 127.0.0.1 in logstash.yml) and use Metricbeat's Logstash module to collect metrics locally rather than exposing port 9600 on the network.

Security risks

1No authentication – the monitoring API has zero auth mechanism in open-source Logstash. Any network-reachable client can query all endpoints.
2Pipeline configuration disclosure – /_node/pipelines reveals input/output plugin configs including Elasticsearch URLs, Kafka brokers, database connection strings, and S3 bucket names.
3Hot threads exposure – /_node/hot_threads leaks JVM stack traces that reveal internal class names, custom plugin code paths, and processing logic.
4Denial of service via stats polling – aggressive polling of /_node/stats can increase GC pressure on the Logstash JVM, impacting pipeline throughput.

Firewall guidance

Bind to localhost exclusively (api.http.host: 127.0.0.1 in logstash.yml). Use Metricbeat's Logstash module running locally to collect and ship metrics to your monitoring cluster. Never expose port 9600 beyond the host – there is no auth to add.

Diagnosis commands

Check pipeline throughput – events in/out/filtered per second

shell

curl -s http://localhost:9600/_node/stats?pretty | jq '.pipelines'

Identify blocked or CPU-intensive threads in the Logstash JVM

shell

curl -s http://localhost:9600/_node/hot_threads

Get Logstash version and basic node info

shell

curl -s http://localhost:9600/?pretty | jq '.version'

Verify which process owns port 9600 and confirm bind address

shell

ss -tlnp sport = :9600

Usage examples

Port 9600 – Elasticsearch / Logstash

shell

curl http://localhost:9600/_node/stats?pretty
curl http://localhost:9600/_node/pipelines?pretty
logstash.yml: api.http.host: 127.0.0.1

Common services on this port

Logstash monitoring APIElasticsearch (alternate config)custom metrics endpoints

Related ports

5044

Beats/Logstash input (Filebeat)

9200

Elasticsearch HTTP API

5601

Kibana dashboard

History

Logstash added the monitoring API in version 5.0 (2016) as part of the Elastic Stack's unified monitoring initiative. Port 9600 was chosen to sit near Elasticsearch's 9200/9300 range. Before this API, monitoring Logstash required parsing log files or JMX – both unreliable for real-time dashboards.

FAQ

Can I add authentication to the Logstash monitoring API?

Not natively in open-source Logstash. The API has no auth plugin system. Your options are: bind to localhost and scrape locally (recommended), or place a reverse proxy with basic auth in front. X-Pack (commercial) adds monitoring through Elasticsearch instead.

What is the performance impact of the monitoring API?

Minimal – stats collection is passive (reads JVM/OS counters). However, aggressive external polling (sub-second intervals) adds GC pressure. Poll at 10-30s intervals maximum. The /_node/hot_threads endpoint is more expensive as it captures thread dumps.