Stop manually curling port 9600: Using MCP to triage Logstash bottlenecks
The author describes a personal ritual for handling Logstash pipeline latency alerts: manually firing curl commands at port 9600 to inspect node stats, pipelines, and plugins. This process is reactive, solo, and requires parsing JSON and correlating JVM heap usage with event flow spikes and thread locks. The author has been experimenting with the Model Context Protocol (MCP) to connect MCP-compatible agents—specifically through Cursor and Claude—directly to Logstash via a specialized API server. They characterize this as an architectural shift from manual inspection to agentic triage, contrasting it with using AI as a documentation search engine. The author notes that asking AI how to configure a JDBC input doesn't help when a production cluster is turning 'yellow' at 3 AM.
MCP enables agentic triage of Logstash bottlenecks, replacing manual curl commands with automated analysis.