Yesterday I started using a config that utilizes the elasticsearch input to run a query. However I noticed the following rather insane behavior:
- All the output received from elastic after Logstash runs the query is saved to /var/log/syslog. This created multi GB files, making my server run out of disk space and crashing it.
- As all the queries are saved to syslog, its all plain text and there for everybody to see.
How can I stop this insanity? I absolutely cannot think of a single reason why this needs to be saved to syslog.
PS. Also noticed the DNS lookup filter also outputs failed lookups to syslog. Again, not necessary.
Edit: It is not only the elastic input, for whatever reason now Logstash is outputting everything to syslog! WTF. I made no changes to Logstash or the existing configs, I removed the two new configs but still same thing is happening.
Running a plain Logstash install on a plain Ubuntu server.