Logstash log4j2.properties gets overriden by dpkg

I've a problem with my custom log4j2.properties file:

While the elasticsearch config is changed to log4j2.properties.dpkg-new, the logstash properties file gets overriden by the paket manager each time I update logstash.

Is this the correct behaviour or do I have to change something in my config? Thanks.

Maybe the package doesn't correctly declare that log4j2.properties is a configuration file. Which version of Logstash are you using?

Hi @magnusbaeck,

I'm currently using 5.4.2 on Debian 8.8.

dpkg -l | grep logstash
ii  logstash                          1:5.4.2-1                          all          An extensible logging pipeline

It's correct: The log4j2.properties is not mentioned in Conffiles:

dpkg --status logstash
Package: logstash
Status: install ok installed
Priority: extra
Section: default
Installed-Size: 172448
Maintainer: <vagrant@packer-virtualbox-iso-1497190395>
Architecture: all
Version: 1:5.4.2-1
 /etc/logstash/jvm.options c4d139ba34295758cb415ce18307551f
 /etc/logstash/logstash.yml 78c6f3948978ceeaed514a5ec6c3970a
 /etc/logstash/startup.options 3e1c05d4a60f786bb9d33373b137032f
Description: An extensible logging pipeline
License: Apache 2.0
Vendor: Elasticsearch
Homepage: http://www.elasticsearch.org/overview/logstash/

In comparison to elasticsearch:

dpkg --status elasticsearch
Package: elasticsearch
Status: install ok installed
Priority: optional
Section: web
Installed-Size: 36261
Maintainer: Elasticsearch Team <info@elastic.co>
Architecture: all
Source: elasticsearch
Version: 5.4.2
Depends: libc6, adduser, bash
 /etc/elasticsearch/elasticsearch.yml 31655f8d9bce94581724510ebc90ed75
 /etc/elasticsearch/jvm.options 451ddbaacd4facb76859208671240121
 /etc/elasticsearch/log4j2.properties 7637854ddf5af38795d69f87bb6b1d76
 /usr/lib/systemd/system/elasticsearch.service a8285cf67cf81c1a0ad092fa19f6448d
 /etc/init.d/elasticsearch b84a9d90a4d0237f55dacc8a7d041735
 /etc/default/elasticsearch bc9c3b8c402dd7c8cc2cba676d5ec056
Description: Elasticsearch is a distributed RESTful search engine built for the cloud. Reference documentation can be found at https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html and the 'Elasticsearch: The Definitive Guide' book can be found at https://www.elastic.co/guide/en/elasticsearch/guide/current/index.html
 Elasticsearch subproject :distribution:deb
Homepage: https://www.elastic.co/

I've filed a PR to address this

1 Like


The PR has been merged to master and backported to the 5.x branch so it should end up in 6.0 and 5.6 (if the latter ever materializes).

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.