# Logs created on default folder

**URL:** <https://discuss.elastic.co/t/logs-created-on-default-folder/44610>\
**Category:** Logstash\
**Created:** [March 16, 2016, 7:48pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610 "2016-03-16T19:48:22Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![evasu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evasu/32/83324_2.png) [@evasu](https://discuss.elastic.co/u/evasu)\
**Post date:** [March 16, 2016, 7:48pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/1 "2016-03-16T19:48:23Z")

</div>

Hi,  
I am new to ELK, when I ran my logstash conf, all my logs created on default folder "/var/log/logstash".

Is there any why to keeps this log files on customize folder as "/home/folder ".

Here is conf ig file  
input  
{  
file  
{  
path =\> "/opt2/log/filename.csv"  
type =\> "audit1"  
start\_position =\> "beginning"  
sincedb\_path =\> "/opt/logstash/.sincedb\_db"  
}  
}

filter {  
if [type] == "audit1"  
{  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp},%{DATA:messageID},%{DATA:referenceIDs},%{WORD:event}}"} }  
date {  
locale =\> "en"  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS", "ISO8601"]  
timezone =\> "EST5EDT"  
remove\_field =\> ["time" ,"month","monthday","year","timestamp"]  
}  
mutate {  
split =\> { "referenceIDs" =\> ";" }  
}  
}  
}

output {  
if !("\_grokparsefailure" in [tags]) {  
if [type] == "audit1" {  
elasticsearch {  
template\_overwrite =\> true  
template\_name =\> filetemplate  
template =\> "/opt/logstash/filetemplate.json"  
codec =\> "plain"  
manage\_template =\> true  
hosts=\> "localhost:9200"  
index =\> "filename-%{+[YYYY.MM](http://YYYY.MM)}"  
}  
}

}  
else {  
stdout { codec =\> rubydebug }  
}  
}

Thanks  
Ema

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 16, 2016, 8:48pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/2 "2016-03-16T20:48:03Z")

</div>

You can use the `-l` flag to tell LS where to log.

---

<div class="post-metadata">

**Author:** ![evasu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evasu/32/83324_2.png) [@evasu](https://discuss.elastic.co/u/evasu)\
**Post date:** [March 16, 2016, 8:57pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/3 "2016-03-16T20:57:13Z")

</div>

Hi Mark,  
Do I need to add any changes on my config file to point out which location.

Because I am able to do it easliy on elasticsearch to keep the log , by edit my elasticsearch.yml file giving my path/to/log to my customize folder '/home/foldername', but not sure how to add this path location on my logstash config file.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 16, 2016, 9:32pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/4 "2016-03-16T21:32:20Z")

</div>

Depends how you installed it, but I think you can add it to `LS_OPTS`.

---

<div class="post-metadata">

**Author:** ![evasu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evasu/32/83324_2.png) [@evasu](https://discuss.elastic.co/u/evasu)\
**Post date:** [March 17, 2016, 1:16pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/5 "2016-03-17T13:16:14Z")

</div>

Hi Mark,  
I install logstash 2.1 on it on Linux,  
so my  
default config are /etc/logstash/conf.d/logstash.conf  
default installation files are /opt/logstash/  
default logs files are /var/log/logstash/ - (this folder i need to change),

So what change i need to add - LS\_OPTS, and where does this changes need.

Appreciate your help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 17, 2016, 10:16pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/6 "2016-03-17T22:16:32Z")

</div>

`/etc/default/logstash` should have that variable where you can set it.

---

<div class="post-metadata">

**Author:** ![evasu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evasu/32/83324_2.png) [@evasu](https://discuss.elastic.co/u/evasu)\
**Post date:** [March 18, 2016, 5:12pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/7 "2016-03-18T17:12:31Z")

</div>

Thanks Mark,  
It was on /etc/sysconfig/logstash, I edit and updated the changes to my customize location.

I works now.

Thanks for your support.

---

<div class="post-metadata">

**Author:** ![emilio](https://avatars.discourse-cdn.com/v4/letter/e/f475e1/32.png) [@emilio](https://discuss.elastic.co/u/emilio)\
**Post date:** [March 7, 2017, 12:50pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/8 "2017-03-07T12:50:07Z")

</div>

What about logstash logs location in CentOS6?

I can't find where to change it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610/9 "2017-07-06T04:28:04Z")

</div>