# Configure stderr logs

**URL:** <https://discuss.elastic.co/t/configure-stderr-logs/27361>\
**Category:** Logstash\
**Created:** [August 14, 2015, 3:18am UTC](https://discuss.elastic.co/t/configure-stderr-logs/27361 "2015-08-14T03:18:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NehaSood](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NehaSood](https://discuss.elastic.co/u/NehaSood)\
**Post date:** [August 14, 2015, 3:18am UTC](https://discuss.elastic.co/t/configure-stderr-logs/27361/1 "2015-08-14T03:18:39Z")

</div>

Hi,

I've logstash running on AWS EC2 instances, which I am using to push data  
to some ElasticSearch instances. Occasionally, I notice a few messages  
getting lost & not being published to ElasticSearch. I am using a very  
basic configuration, with 1 input thread that reads from a log file locally  
& 1 ElasticSearch output worker that publishes the data.

Reading through the logstash documentation tells me, that the failed  
messages are retried (for configurable number of times), if they fall under  
the "retryable errors" bracket. After all retries are done, the failed  
messages are logged in stderr.

Is there any way I could configure the error output file location?  
Also, does the elasticsearch output plugin buffer the messages & send them  
in batches? If yes, is it possible to configure the batch size?

(FYI, I am starting logstash as a service using Chef)

Please help.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 14, 2015, 6:02am UTC](https://discuss.elastic.co/t/configure-stderr-logs/27361/2 "2015-08-14T06:02:27Z")

</div>

> Is there any way I could configure the error output file location?

The log file location depends on how Logstash is invoked, but logs are usually stored in /var/log/logstash.

> Also, does the elasticsearch output plugin buffer the messages & send them  
> in batches? If yes, is it possible to configure the batch size?

Yes, events are batched. See the [`flush_size`](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-flush_size) configuration option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/configure-stderr-logs/27361/3 "2017-07-06T05:32:00Z")

</div>

Closed on July 6, 2017, 5:32am UTC