# Logstash Beats input lumberjack protocol v1 support lifetime
**URL:** https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334
**Category:** Beats
**Created:** [July 25, 2016, 9:05pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334 "2016-07-25T21:05:06Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@CVTJNII](https://discuss.elastic.co/u/CVTJNII)
#### Post date: [July 25, 2016, 9:05pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/1 "2016-07-25T21:05:06Z")
Currently the Beats input supports the Lumberjack v1 protocol, which is documented in the [PROTOCOL.md file](https://github.com/logstash-plugins/logstash-input-beats/blob/master/PROTOCOL.md) in the logstash-input-beats repository. I'm currently using this to test the beats input and am interested in expanding it's use in our environment. However, my understanding is Lumberjack has been deprecated for Beats, but I'm not clear if the wire protocol has changed as well. Is this protocol deprecated? How long is it intended to be supported?
Thanks!
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [July 26, 2016, 9:10am UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/2 "2016-07-26T09:10:13Z")
beats -\> logstash still use lumberjack, but with version number being increased to v2. v2 adds support for a json data-frame and partial ACK that can also be used as keep-alive signal be returning `ACK 0` until full batches have been processed.
---
### Author:  [@CVTJNII](https://discuss.elastic.co/u/CVTJNII)
#### Post date: [July 26, 2016, 1:00pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/3 "2016-07-26T13:00:21Z")
Okay, so [PROTOCOL.md](http://PROTOCOL.md) has the JSON frame but still says version 1, is that actually version 2, then?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [July 27, 2016, 12:51pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/4 "2016-07-27T12:51:40Z")
right, JSON frame is v2.
---
### Author:  [@CVTJNII](https://discuss.elastic.co/u/CVTJNII)
#### Post date: [July 27, 2016, 2:09pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/5 "2016-07-27T14:09:05Z")
Okay, so the [PROTOCOL.md](http://PROTOCOL.md) file is out of date, easily fixed with a PR. So to clarify the original question, the lumberjack protocol is still the official protocol and will be supported long term?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [July 27, 2016, 6:45pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/6 "2016-07-27T18:45:45Z")
not sure if JSON frame is supported by v1.
beats -\> logstash uses lumberjack v2 from the very beginning. This is true for beats 1.x release and upcoming beats 5.x release.
As far as I can tell, the logstash beats input plugin supports both v1 and v2. If and when this will change once logstash forward (which uses lumberjack v1) out of lifetime I don't know. The beats plugin development is mostly driven by logstash. See [github](https://github.com/logstash-plugins/logstash-input-beats)
---
### Author:  [@CVTJNII](https://discuss.elastic.co/u/CVTJNII)
#### Post date: [July 28, 2016, 9:36pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/7 "2016-07-28T21:36:14Z")
Okay, so Lumberjack v2 is the officially supported protocol as of right now, correct? If so then I think that answers my question.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [July 29, 2016, 11:39am UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/8 "2016-07-29T11:39:32Z")
No idea what you intend by 'officially supported'. Lumberjack v2 is the 'official' protocol used by beats-\>logstash only. Protocol might change as we see a need to do so to improve beats-\>logstash integration. There is no interest in 'officially' supporting any other tools using the protocol. Official implementations are available in [go-lumber](https://github.com/elastic/go-lumber) and [logstash beat input plugin](https://github.com/logstash-plugins/logstash-input-beats).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 15, 2016, 9:05pm UTC](https://discuss.elastic.co/t/logstash-beats-input-lumberjack-protocol-v1-support-lifetime/56334/9 "2016-08-15T21:05:28Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.