How can I change the location of Logstash's logs?

[dolanmk]

Hi,

I am hoping to change the location of where Logstash stores the logs it creates of its own actions. As I understand it right now, this can be done with path.logs in the logstash.yml file. However, it doesn't seem as though I can't get the syntax correct. This is what I have right now and nothing is being generated in this location.

path.logs: "D:\apps\ELK2\logstash-5.3.0\logs"

Also, my ultimate goal would be for Logstash to recognize the current directory (where the yml file is located is fine) to store the logs so that this won't have to be user defined if moving to a different machine.

I apologize if any of this is unclear. Thank you for your help!

Miranda

[jkuang (Jimmy Kuang)]

path.logs is the correct setting. Are you using windows or Linux?

[dolanmk]

Thank you for responding! I am using a windows machine.

[jkuang (Jimmy Kuang)]

What happens if you specify it within the startup script?

./bin/elasticsearch -Epath.logs="C:\My Logs\logs"

[dolanmk]

I'm so sorry, I think you lost me. Are you saying to do this as a command line argument?

[jkuang (Jimmy Kuang)]

Yes, what happens if you specify the path.logs on the command line argument.

[dolanmk]

I used the following command:

.\bin>logstash -f syslog.conf -l D:/apps/ELK2/logstash-5.3.0/logs

Logstash worked perfectly fine but the internal logs were not sent to the directory I specified.

Also, when I did logstash -h to get the proper command for the path specification, the help message listed the default file (the path I set in logstash.yml) for the internal logs. This path is correct but nothing is actually being written here.

-l, --path.logs PATH          Write logstash internal logs to the given
                              file. Without this flag, logstash will emit
                              logs to standard output.
                               (default: "D:/apps/ELK2/logstash-5.3.0/logs")