How to log auditbeat/metricbeat output not to syslog?

I have example config. And i still don't see any files in /tmp/ folder. All auditbeat log goes to syslog? Is it possible to log it into file instead of syslog?

My current config:

logging.level: warning
logging.to_syslog: false
logging.to_files: true
logging.files.path: /tmp/ auditbeat
logging.files.keepfiles: 7
logging.files.permissions: 0644

Finally found that it's a "feature"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.