Docker Logstash internal logging to file?

I'm having a similar problem as two posters before me, whose posts did not get resolved:

I am hoping that this time, we can find a solution.

I am using the Logstash docker container (
I can see the internal logging just fine by running:
docker logs -f logstash
However, I need the internal logging to be saved to file inside the docker container, for various reasons.

Since there is no file in the logstash docker container by default, I have created the following file and placed it in the container's /etc/logstash AND /usr/share/logstash/config (since there is conflicting information online about where to put this file):

# Root logger option
log4j.rootLogger=INFO, file, stdout

# Direct log messages to a log file
log4j.appender.file.layout.ConversionPattern=%d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n

# Direct log messages to stdout
log4j.appender.stdout.layout.ConversionPattern=%d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n

I based the above file on the one specified in this page, since it seemed like it would suit my needs:

After restarting the container, the internal logging still does not appear in files in /var/log/logstash/

I am aware that there may also be a solution to do with appending parameters when running logstash initially, but since logstash starts automatically when creating/running the logstash docker container, I'm not sure if that's a feasible solution in this case.

Could anyone point out what I am doing wrong? How can we get internal logging to files when running the standard logstash docker container?

After a more careful look at the logstash internal logs, it looks like it was looking for '/usr/share/logstash/config/'.

After renaming the .properties file to include the '2', the internal logs now say:
Sending Logstash logs to /var/log/logstash which is now configured via
However, the log files are not appearing in /var/log/logstash. I've used chmod to give full accessibility to this folder in case logstash simply didn't have the permissions to write files in this folder, but that doesn't seem to help.

I've been looking at


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.