There is a community supported Logstash input plugin for Salesforce. It is not installed by default, but you can use the plugin command to add it. The command is slightly different depending on the version of Logstash that you are using:

• Logstash version 2.2:

cd /opt/logstash
bin/plugin install logstash-input-salesforce

• Logstash version 2.3:

cd /opt/logstash
bin/logstash-plugin install logstash-input-salesforce

To configure the plugin to use the credentials from Salesforce, create a file located at /etc/logstash/conf.d/salesforce.conf like:

input {
  salesforce {
    client_id => 'OAUTH CLIENT ID FROM YOUR SFDC APP'
    client_secret => 'OAUTH CLIENT SECRET FROM YOUR SFDC APP'
    username => 'email@example.com'
    password => 'super-secret'
    security_token => 'SECURITY TOKEN FOR THIS USER'
    sfdc_object_name => 'Opportunity'
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

sfdc_object_name can be any of the objects provided by the Salesforce API.

See this blog post by the team at Elastic and the plugin’s documentation for all the configuration information.