# Logstash log file location

**URL:** <https://discuss.elastic.co/t/logstash-log-file-location/327307>\
**Category:** Logstash\
**Created:** [March 8, 2023, 8:41pm UTC](https://discuss.elastic.co/t/logstash-log-file-location/327307 "2023-03-08T20:41:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [March 8, 2023, 8:41pm UTC](https://discuss.elastic.co/t/logstash-log-file-location/327307/1 "2023-03-08T20:41:03Z")

</div>

I am running logstash as daemon via systemd

I get my log in to my special log dir /log/logstash/logstash-plain.log  
but I also get that in /var/log/message. I want to stop them and I read that it is control by log4j2 file.

but I do not know which lines to comment out. Anyone has done this in past?

I do not want to change service configuration file because it gets overwritten when I do upgrade.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 9, 2023, 12:56am UTC](https://discuss.elastic.co/t/logstash-log-file-location/327307/2 "2023-03-09T00:56:51Z")

</div>

Comment out the line

```
rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console

```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [March 9, 2023, 2:57pm UTC](https://discuss.elastic.co/t/logstash-log-file-location/327307/3 "2023-03-09T14:57:19Z")

</div>

Great thanks, it is working

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2023, 2:57pm UTC](https://discuss.elastic.co/t/logstash-log-file-location/327307/4 "2023-04-06T14:57:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.