# Logstash 8.14.3 not logging to /var/log/logstash

**URL:** <https://discuss.elastic.co/t/logstash-8-14-3-not-logging-to-var-log-logstash/364721>\
**Category:** Logstash\
**Created:** [August 9, 2024, 7:41pm UTC](https://discuss.elastic.co/t/logstash-8-14-3-not-logging-to-var-log-logstash/364721 "2024-08-09T19:41:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![apal](https://avatars.discourse-cdn.com/v4/letter/a/bc8723/32.png) [@apal](https://discuss.elastic.co/u/apal)\
**Post date:** [August 9, 2024, 7:41pm UTC](https://discuss.elastic.co/t/logstash-8-14-3-not-logging-to-var-log-logstash/364721/1 "2024-08-09T19:41:01Z")

</div>

Hi,

This is my `log4j2.properties`:

```auto
# status = error
status = info
name = LogstashPropertiesConfig

appender.console.type = Console
appender.console.name = plain_console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n

appender.json_console.type = Console
appender.json_console.name = json_console
appender.json_console.layout.type = JSONLayout
appender.json_console.layout.compact = true
appender.json_console.layout.eventEol = true

appender.rolling.type = RollingFile
appender.rolling.name = plain_rolling
appender.rolling.fileName = ${sys:ls.logs}/logstash-plain.log
appender.rolling.filePattern = ${sys:ls.logs}/logstash-plain-%d{yyyy-MM-dd}-%i.log.gz
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.rolling.policies.size.size = 100MB
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.max = 30
appender.rolling.avoid_pipelined_filter.type = PipelineRoutingFilter

appender.json_rolling.type = RollingFile
appender.json_rolling.name = json_rolling
appender.json_rolling.fileName = ${sys:ls.logs}/logstash-json.log
appender.json_rolling.filePattern = ${sys:ls.logs}/logstash-json-%d{yyyy-MM-dd}-%i.log.gz
appender.json_rolling.policies.type = Policies
appender.json_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.json_rolling.policies.time.interval = 1
appender.json_rolling.policies.time.modulate = true
appender.json_rolling.layout.type = JSONLayout
appender.json_rolling.layout.compact = true
appender.json_rolling.layout.eventEol = true
appender.json_rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.json_rolling.policies.size.size = 100MB
appender.json_rolling.strategy.type = DefaultRolloverStrategy
appender.json_rolling.strategy.max = 30
appender.json_rolling.avoid_pipelined_filter.type = PipelineRoutingFilter

appender.routing.type = PipelineRouting
appender.routing.name = pipeline_routing_appender
appender.routing.pipeline.type = RollingFile
appender.routing.pipeline.name = appender-${ctx:pipeline.id}
appender.routing.pipeline.fileName = ${sys:ls.logs}/pipeline_${ctx:pipeline.id}.log
appender.routing.pipeline.filePattern = ${sys:ls.logs}/pipeline_${ctx:pipeline.id}.%i.log.gz
appender.routing.pipeline.layout.type = PatternLayout
appender.routing.pipeline.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n
appender.routing.pipeline.policy.type = SizeBasedTriggeringPolicy
appender.routing.pipeline.policy.size = 100MB
appender.routing.pipeline.strategy.type = DefaultRolloverStrategy
appender.routing.pipeline.strategy.max = 30

rootLogger.level = ${sys:ls.log.level}
rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console
rootLogger.appenderRef.rolling.ref = ${sys:ls.log.format}_rolling
rootLogger.appenderRef.routing.ref = pipeline_routing_appender

# Slowlog

appender.console_slowlog.type = Console
appender.console_slowlog.name = plain_console_slowlog
appender.console_slowlog.layout.type = PatternLayout
appender.console_slowlog.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n

appender.json_console_slowlog.type = Console
appender.json_console_slowlog.name = json_console_slowlog
appender.json_console_slowlog.layout.type = JSONLayout
appender.json_console_slowlog.layout.compact = true
appender.json_console_slowlog.layout.eventEol = true

appender.rolling_slowlog.type = RollingFile
appender.rolling_slowlog.name = plain_rolling_slowlog
appender.rolling_slowlog.fileName = ${sys:ls.logs}/logstash-slowlog-plain.log
appender.rolling_slowlog.filePattern = ${sys:ls.logs}/logstash-slowlog-plain-%d{yyyy-MM-dd}-%i.log.gz
appender.rolling_slowlog.policies.type = Policies
appender.rolling_slowlog.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling_slowlog.policies.time.interval = 1
appender.rolling_slowlog.policies.time.modulate = true
appender.rolling_slowlog.layout.type = PatternLayout
appender.rolling_slowlog.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n
appender.rolling_slowlog.policies.size.type = SizeBasedTriggeringPolicy
appender.rolling_slowlog.policies.size.size = 100MB
appender.rolling_slowlog.strategy.type = DefaultRolloverStrategy
appender.rolling_slowlog.strategy.max = 30

appender.json_rolling_slowlog.type = RollingFile
appender.json_rolling_slowlog.name = json_rolling_slowlog
appender.json_rolling_slowlog.fileName = ${sys:ls.logs}/logstash-slowlog-json.log
appender.json_rolling_slowlog.filePattern = ${sys:ls.logs}/logstash-slowlog-json-%d{yyyy-MM-dd}-%i.log.gz
appender.json_rolling_slowlog.policies.type = Policies
appender.json_rolling_slowlog.policies.time.type = TimeBasedTriggeringPolicy
appender.json_rolling_slowlog.policies.time.interval = 1
appender.json_rolling_slowlog.policies.time.modulate = true
appender.json_rolling_slowlog.layout.type = JSONLayout
appender.json_rolling_slowlog.layout.compact = true
appender.json_rolling_slowlog.layout.eventEol = true
appender.json_rolling_slowlog.policies.size.type = SizeBasedTriggeringPolicy
appender.json_rolling_slowlog.policies.size.size = 100MB
appender.json_rolling_slowlog.strategy.type = DefaultRolloverStrategy
appender.json_rolling_slowlog.strategy.max = 30

logger.slowlog.name = slowlog
logger.slowlog.level = error
logger.slowlog.appenderRef.console_slowlog.ref = ${sys:ls.log.format}_console_slowlog
logger.slowlog.appenderRef.rolling_slowlog.ref = ${sys:ls.log.format}_rolling_slowlog
logger.slowlog.additivity = false

logger.licensereader.name = logstash.licensechecker.licensereader
logger.licensereader.level = error

# Silence http-client by default
logger.apache_http_client.name = org.apache.http
logger.apache_http_client.level = fatal

# Deprecation log
appender.deprecation_rolling.type = RollingFile
appender.deprecation_rolling.name = deprecation_plain_rolling
appender.deprecation_rolling.fileName = ${sys:ls.logs}/logstash-deprecation.log
appender.deprecation_rolling.filePattern = ${sys:ls.logs}/logstash-deprecation-%d{yyyy-MM-dd}-%i.log.gz
appender.deprecation_rolling.policies.type = Policies
appender.deprecation_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.deprecation_rolling.policies.time.interval = 1
appender.deprecation_rolling.policies.time.modulate = true
appender.deprecation_rolling.layout.type = PatternLayout
appender.deprecation_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n
appender.deprecation_rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.deprecation_rolling.policies.size.size = 100MB
appender.deprecation_rolling.strategy.type = DefaultRolloverStrategy
appender.deprecation_rolling.strategy.max = 30

logger.deprecation.name = org.logstash.deprecation, deprecation
logger.deprecation.level = error
logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_plain_rolling
logger.deprecation.additivity = false

logger.deprecation_root.name = deprecation
logger.deprecation_root.level = error
logger.deprecation_root.appenderRef.deprecation_rolling.ref = deprecation_plain_rolling
logger.deprecation_root.additivity = false

```

Other than `status = info` in the very first line, I have otherwise not edited this file.

Please let me know if you need my `logstash.yml` too, but in short, the relevant parts are:

```auto
# Options for log.level:
# * fatal
# * error
# * warn
# * info (default)
# * debug
# * trace
log.level: info
#
# Options for log.format:
# * plain (default)
# * json
#
log.format: plain
# log.format.json.fix_duplicate_message_fields: false
#
path.logs: /var/log/logstash

```

The directory where it is supposed to be logging:

```auto
# ls -l /var/log/ | grep logstash
lrwxrwxrwx. 1 logstash logstash 24 Jun 10 14:03 logstash

```

I'm not sure what I'm doing wrong here. I have read other posts, including the one which edits the systemd service file (yes, I'm running this as a service), but not pushing to `/var/log/messages` isn't the problem here - it's that nothing is going into `/var/log/logstash`.

I really appreciate your help!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2024, 8:35pm UTC](https://discuss.elastic.co/t/logstash-8-14-3-not-logging-to-var-log-logstash/364721/2 "2024-08-09T20:35:46Z")

</div>

> [@apal](#):
>
> ```auto
> # ls -l /var/log/ | grep logstash
> lrwxrwxrwx. 1 logstash logstash 24 Jun 10 14:03 logstash
> 
> ```

What is it a link to? You need to check the permissions on the directory and the logs within it, not the link pointing to it.

For me, after a logstash upgrade, I have

```
ls -ld /var/log/logstash
drwxr-xr-x 2 logstash root 12288 Jul 24 05:39 /var/log/logstash

```

which I then fix using

```
sudo /bin/sh -c 'chgrp logstash /var/log/logstash; chmod g+w /var/log/logstash'

```

---

<div class="post-metadata">

**Author:** ![apal](https://avatars.discourse-cdn.com/v4/letter/a/bc8723/32.png) [@apal](https://discuss.elastic.co/u/apal)\
**Post date:** [August 9, 2024, 9:08pm UTC](https://discuss.elastic.co/t/logstash-8-14-3-not-logging-to-var-log-logstash/364721/3 "2024-08-09T21:08:10Z")

</div>

Thanks for responding. It points to `/usr/share/logstash/logs`, which is owned by `logstash`:

```auto
# ls -l /usr/share/ | grep logstash
drwxrwxr-x+ 13 logstash logstash 4096 Jul 11 19:12 logstash
# ls -l /usr/share/logstash | grep -w "logs"
drwxr-xr-x. 2 logstash logstash 4096 Aug 9 13:40 logs

```

Unfortunately:

```auto
# ls -al /usr/share/logstash/logs
total 24
drwxr-xr-x. 2 logstash logstash 4096 Aug 9 13:40 .
drwxrwxr-x+ 13 logstash logstash 4096 Jul 11 19:12 ..
-rw-r--r--. 1 logstash logstash 0 Aug 8 14:26 logstash-deprecation.log
-rw-r--r--. 1 logstash logstash 0 Aug 8 14:26 logstash-json.log
-rw-r--r--. 1 logstash logstash 0 Aug 8 14:26 logstash-plain.log
-rw-r--r--. 1 logstash logstash 0 Aug 8 14:26 logstash-slowlog-json.log
-rw-r--r--. 1 logstash logstash 0 Aug 8 14:26 logstash-slowlog-plain.log

```

I've been testing it today and I have nothing.