Logging options in logstash.yml are not working

Elastic Stack Logstash
1

Hi there!

We want Logstash to send its logging to a specified location.

If we set (the data folder is mounted external from the docker):

log.level: warn
path.logs: /usr/share/logstash/data/log

It does not create a file an send its logs to it.
We also tried with a filename

log.level: warn
path.logs: /usr/share/logstash/data/log/logstash.log

But this also doesn't work. From your documentation this should work without a problem.
Are we doing something wrong?

A Sidenote: We have an queue folder for the persistent queue's in exactly the same way configured, and this works without any problems, so we don't understand why this shouldn't work.

We are using the official docker images, version 6.3.1

2

My guess would be that the user running logstash does not have permission to write to that directory (and it should be a directory, not a file). If you run logstash on the command line it should write its logs to the console as well, so if it is getting an error you should see that.

3

It will be necessary to specify the permissions.

4

Okay, so could be an permissions issue. If I check the docker logs I see the following:

Sending Logstash's logs to /usr/share/logstash/data/log which is now configured via log4j2.properties

So the setting is correct. Do I need to set the permissions via the log4j2.properties file?

If I check our config for the persistent queue's we set this path:

path.queue: /usr/share/logstash/data/queue

We didn't set any permissions for this, and it works right away.
The permissions outside the docker container are set to 1000:1000 so the logstash user can access it. The queue directory works great, but the log directory stays empty..

5 
bin/logstash-plugin update logstash-input-log4j
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.