# 8.16.1 ignores to\_syslog: false

**URL:** <https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 1, 2024, 11:16am UTC](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276 "2024-12-01T11:16:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![t.alexandersen](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@t.alexandersen](https://discuss.elastic.co/u/t.alexandersen)\
**Post date:** [December 1, 2024, 11:16am UTC](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276/1 "2024-12-01T11:16:42Z")

</div>

We upgraded from 8.15.3 to 8.16.1 and found that filebeat started filling up syslog with debug log messages. It seems to ignore the to\_syslog: false config. Downgraded to 8.15.3 and the problem was gone. Did we miss changes to logging or other major changes that could cause this?

Here is our current config.

```auto
BEAT_LOG_OPTS=

```

and

```auto
logging:
    files:
        keepfiles: 3
        name: filebeat.log
        path: /var/log/filebeat
    level: debug
    to_files: true
    to_syslog: false

```

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [December 2, 2024, 4:38pm UTC](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276/2 "2024-12-02T16:38:07Z")

</div>

Hi @t.alexandersen, could you share how you're running and installed Filebeat?

- Is it running via Systemd?
- What are the CLI arguments passed to Filebeat?
- Can you share the output of `ps aux |grep filebeat`?

Your logging configuration is correct, so Filebeat should be logging only to `/var/log/filebeat`. Filebeat does not support multiple log outputs.

- Can you see the log files on `/var/log/filebeat`?
- Are they correctly updated/are they active while Filebeat is running?

---

<div class="post-metadata">

**Author:** ![t.alexandersen](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@t.alexandersen](https://discuss.elastic.co/u/t.alexandersen)\
**Post date:** [December 3, 2024, 7:48am UTC](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276/3 "2024-12-03T07:48:12Z")

</div>

Hi @TiagoQueiroz

Thanks for following up.

We found the reason for the new behaviour. It is caused by this issue:

> <https://github.com/elastic/beats/issues/41767>
>
> Filebeat versions of 8.15.4 and higher no longer logs to "logging.files.path" wh…en "logging.to\_files: true" is set, unless "logging.to\_stderr: false" is explicitly set.
> 
> In versions \<=8.15.3, setting "logging.to\_stderr: false" was not required for "logging.to\_files: true" to be honored.
> 
> \- Filebeat \>=8.15.4: 
> \- Operating System: Rocky Linux 8.10, Ubuntu 22.04.5
> \- Steps to Reproduce: 
> 
> 1. Run Filebeat version \>=8.15.4 with the following logging configuration:
> \`\`\`
> logging.level: info
> logging.to\_files: true
> logging.files:
> path: /var/log/filebeat
> name: filebeat
> keepfiles: 7
> permissions: 0640
> \`\`\`
> 2. Log files are not created under "logging.file.path".
> 3. Revert to running Filebeat \<=8.15.3 with the same configuration.
> 4. Log files are created under "logging.file.path".
> 
> I see nothing in the release notes about this behavioral change, is it expected?

logging.to\_files: true is no longer honored unless you set logging.to\_stderr: false.

The workaround is to add logging.to\_stderr: false to your config.

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [December 3, 2024, 10:49pm UTC](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276/4 "2024-12-03T22:49:25Z")

</div>

Thanks @t.alexandersen

I'm just a bit puzzled because I still cannot reproduce it.

Could you try reproducing with the configuration [from my comment](https://github.com/elastic/beats/issues/41767#issuecomment-2515702039) and also post here the output of `./filebeat version`?

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [December 4, 2024, 9:34pm UTC](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276/5 "2024-12-04T21:34:23Z")

</div>

In the [GitHub issue](https://github.com/elastic/beats/issues/41767) we managed to find the root cause and a workaround. Look at the issue for more details.

As a workaround, one can set `logging.to_stderr: false` to stop logging to stderr.

Here is an example of how to get logging back to files:

```auto
logging.level: info
logging.to_files: true
logging.to_stderr: false

```