Logsstash filling up /var/log/syslog?

[mathurin68]

syslog in /var/log filling up with logstash?

Every event coming through logstash is filling up syslog -
ogstash[54646]: "type" => "wineventlog",
Nov 18 06:25:05 elkstack logstash[54646]: "opcode" => "Info",
Nov 18 06:25:05 elkstack logstash[54646]: "version" => 1,
Nov 18 06:25:05 elkstack logstash[54646]: "tags" => [
Nov 18 06:25:05 elkstack logstash[54646]: [0] "beats_input_codec_plain_applied"
Nov 18 06:25:05 elkstack logstash[54646]: ],

This is what I have in conf.d -
ack:/etc/logstash/conf.d# grep -r "syslog" .
./10-syslog-filter.conf: if [type] == "syslog" {
./10-syslog-filter.conf: match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
./10-syslog-filter.conf: syslog_pri { }
./10-syslog-filter.conf: match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]

Maybe this is normal, not sure...

[warkolm (Mark Walkom)]

Looks like you have a stdout output somewhere.

[mathurin68]

Thanks Mark!

[Jason_Brooks]

Hello warkolm,

Does this mean that when daemonized and stdout is defined, that everything is written to syslog?

That's good to know.

--jason

[warkolm (Mark Walkom)]

Yes, because that is stdout when daemonised.