# Logstash filling up my space inside/var/log/messages file

**URL:** <https://discuss.elastic.co/t/logstash-filling-up-my-space-inside-var-log-messages-file/311415>\
**Category:** Logstash\
**Created:** [August 4, 2022, 11:50am UTC](https://discuss.elastic.co/t/logstash-filling-up-my-space-inside-var-log-messages-file/311415 "2022-08-04T11:50:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zanoob](https://avatars.discourse-cdn.com/v4/letter/z/a6a055/32.png) [@zanoob](https://discuss.elastic.co/u/zanoob)\
**Post date:** [August 4, 2022, 11:50am UTC](https://discuss.elastic.co/t/logstash-filling-up-my-space-inside-var-log-messages-file/311415/1 "2022-08-04T11:50:14Z")

</div>

Hello all,

I been tying to find a solution for this since long. Trying to reach out to the community.

The logstash is filling up the file /var/log/messages file space,  
I understand logstash does not log to /var/log/message, it writes to stdout and it logs to /var/log/logstash.

I am running logstash as a service and I think it may be because the service manager is configured to cc the stdout of a service to /var/log/messages which then the service manager will write to /var/log/messages. I don't think Ican reconfigure service manager. I edited the log4j.proprties file of logstah where I commented out the following lines and restarted logstash service and the system , still the logstash is logging everysecond the logs to /var/log/messages

\<  
rootLogger.appenderRef.console.ref = ${sys:ls.log.format}\_console  
logger.slowlog.appenderRef.console\_slowlog.ref = ${sys:ls.log.format}\_console\_slowlog  
/\>

I also tried to create a new empty file with name /var/log/messages and renamed the old file as messagesold. That did not help as well. The messages are still getting logged to /var/log/messagesold.

Is there any way I could delete these file or rotate it to delete the first 10 gig of data inside /var/log/message file when it reaches 50 Gig.

I am afraid if I delete the file itself I don't see any more data in my elastic search or kibana.  
Also, will need to manually delete everytime the file becomes more than 50gig.  
Regards,  
Zanoob

---

<div class="post-metadata">

**Author:** ![zanoob](https://avatars.discourse-cdn.com/v4/letter/z/a6a055/32.png) [@zanoob](https://discuss.elastic.co/u/zanoob)\
**Post date:** [August 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-filling-up-my-space-inside-var-log-messages-file/311415/2 "2022-08-04T13:06:39Z")

</div>

just deleted the file and restarted the system , all works fine.  
Added a logrotate entry inside logrotate.conf

`/var/log/messages { rotate 3 size 1G postrotate /usr/bin/killall -HUP syslogd endscript }`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2022, 1:07pm UTC](https://discuss.elastic.co/t/logstash-filling-up-my-space-inside-var-log-messages-file/311415/3 "2022-09-01T13:07:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.