Logs created on default folder

Elastic Stack Logstash
1

Hi,
I am new to ELK, when I ran my logstash conf, all my logs created on default folder "/var/log/logstash".

Is there any why to keeps this log files on customize folder as "/home/folder ".

Here is conf ig file
input
{
file
{
path => "/opt2/log/filename.csv"
type => "audit1"
start_position => "beginning"
sincedb_path => "/opt/logstash/.sincedb_db"
}
}

filter {
if [type] == "audit1"
{
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp},%{DATA:messageID},%{DATA:referenceIDs},%{WORD:event}}"} }
date {
locale => "en"
match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS", "ISO8601" ]
timezone => "EST5EDT"
remove_field => [ "time" ,"month","monthday","year","timestamp" ]
}
mutate {
split => { "referenceIDs" => ";" }
}
}
}

output {
if !("_grokparsefailure" in [tags]) {
if [type] == "audit1" {
elasticsearch {
template_overwrite => true
template_name => filetemplate
template => "/opt/logstash/filetemplate.json"
codec => "plain"
manage_template => true
hosts=> "localhost:9200"
index => "filename-%{+YYYY.MM}"
}
}

}
else {
stdout { codec => rubydebug }
}
}

Thanks
Ema

2

You can use the -l flag to tell LS where to log.

3

Hi Mark,
Do I need to add any changes on my config file to point out which location.

Because I am able to do it easliy on elasticsearch to keep the log , by edit my elasticsearch.yml file giving my path/to/log to my customize folder '/home/foldername', but not sure how to add this path location on my logstash config file.

4

Depends how you installed it, but I think you can add it to LS_OPTS.

5

Hi Mark,
I install logstash 2.1 on it on Linux,
so my
default config are /etc/logstash/conf.d/logstash.conf
default installation files are /opt/logstash/
default logs files are /var/log/logstash/ - (this folder i need to change),

So what change i need to add - LS_OPTS, and where does this changes need.

Appreciate your help.

6

/etc/default/logstash should have that variable where you can set it.

7

Thanks Mark,
It was on /etc/sysconfig/logstash, I edit and updated the changes to my customize location.

I works now.

Thanks for your support.

8

What about logstash logs location in CentOS6?

I can't find where to change it