# File beat log messages causing disk space to be full
**URL:** https://discuss.elastic.co/t/file-beat-log-messages-causing-disk-space-to-be-full/310991
**Category:** Beats
**Tags:** filebeat
**Created:** [July 29, 2022, 1:54pm UTC](https://discuss.elastic.co/t/file-beat-log-messages-causing-disk-space-to-be-full/310991 "2022-07-29T13:54:20Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@zanoob](https://discuss.elastic.co/u/zanoob)
#### Post date: [July 29, 2022, 1:54pm UTC](https://discuss.elastic.co/t/file-beat-log-messages-causing-disk-space-to-be-full/310991/1 "2022-07-29T13:54:20Z")
Hello all,
Hope someone had this issue before.
Look like my /var/log/messages is getting really high since we have configured filebeat.
The disk space is getting lower and almost 95% of this.
How can I make sure that old log messages are being deleted?
'''''
[root@srvde432 log]# pwd
/var/log
[root@srvde432 log]# ls -lh | grep messages
-rw-------. 1 root root 24G Jul 29 15:51 messages
-rw-------. 1 root root 1.4G Feb 6 03:39 messages-20220206
'''''
Regards,
Zanoob
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 29, 2022, 2:28pm UTC](https://discuss.elastic.co/t/file-beat-log-messages-causing-disk-space-to-be-full/310991/2 "2022-07-29T14:28:02Z")
Try to add the following lines in your filebeat configuration and restart filebeat.
```auto
logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0640
```
This will make filebeat log to a file named `filebeat` inside of `/var/log/filebeat`, and keep the last 7 log files, it will stop logging to `/var/log/messages`.
---
### Author:  [@zanoob](https://discuss.elastic.co/u/zanoob)
#### Post date: [August 4, 2022, 12:00pm UTC](https://discuss.elastic.co/t/file-beat-log-messages-causing-disk-space-to-be-full/310991/3 "2022-08-04T12:00:11Z")
Hello there,
Thank for the response.
actually it's not the filebeast that is filling up /var/log/message file. Its the logstash which is filling it out.
Aug 4 13:36:18 srvde432 logstash: "country\_code2" =\> "
Aug 4 13:36:18 srvde432 logstash: "continent\_code" =\> "
Aug 4 13:36:18 srvde432 logstash: "city\_name" =\> "
Aug 4 13:36:18 srvde432 logstash: "longitude" =\>
Aug 4 13:36:18 srvde432 logstash: "region\_code" =\> "
Aug 4 13:36:18 srvde432 logstash: "country\_code3" =\>
Aug 4 13:36:18 srvde432 logstash: "timezone" =\>
Aug 4 13:36:18 srvde432 logstash: "country\_name" =\>
Aug 4 13:36:18 srvde432 logstash: "postal\_code" =\> "
Aug 4 13:36:18 srvde432 logstash:
I tried to comment out the option inside the logstash log4.properties file
rootLogger.appenderRef.console.ref = ${sys:ls.log.format}\_console
logger.slowlog.appenderRef.console\_slowlog.ref = ${sys:ls.log.format}\_console\_slowlog
and restarted the system , still no use, it keeps on logging.
Also tried to rename the file to messagesold and created to new file and restarted service.
That did not work as well, it still logging to /var/log/messagesold (even after renaming it , still logstash is sending it to that file).
Regards,
Zanoob
---
### Author:  [@zanoob](https://discuss.elastic.co/u/zanoob)
#### Post date: [August 4, 2022, 1:02pm UTC](https://discuss.elastic.co/t/file-beat-log-messages-causing-disk-space-to-be-full/310991/4 "2022-08-04T13:02:57Z")
I just deleted the file and restarted the system and everything works fine.
Thank you .
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2022, 3:03pm UTC](https://discuss.elastic.co/t/file-beat-log-messages-causing-disk-space-to-be-full/310991/5 "2022-09-01T15:03:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.