# Logstash logging problem

**URL:** <https://discuss.elastic.co/t/logstash-logging-problem/280329>\
**Category:** Logstash\
**Created:** [August 3, 2021, 2:19pm UTC](https://discuss.elastic.co/t/logstash-logging-problem/280329 "2021-08-03T14:19:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 3, 2021, 2:19pm UTC](https://discuss.elastic.co/t/logstash-logging-problem/280329/1 "2021-08-03T14:19:07Z")

</div>

using 7.13.4

having problem with logstash logging.  
I need two thing

I want is to keep my log at my location .  
second I don't want all stdout message that comes out from conf file when it runs via pipeline.

starting logstash as service and it is sending all log to /var/log/messages including all the stdout

here is my configuration of logstash.yml  
same setting works on older versions

```auto
log.level: info
path.logs: /s1/log/logstash

```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 3, 2021, 4:18pm UTC](https://discuss.elastic.co/t/logstash-logging-problem/280329/2 "2021-08-03T16:18:12Z")

</div>

Both are working. But I don't like changing system startup file. because on next upgrade it will be change back and I will forget to change it back. How do I make this work without changing  
/etc/systemd/system/logstash.service file

I have change log4j2.properties file like below.

```auto

status = error
name = LogstashPropertiesConfig

appender.console.type = Console
appender.console.name = plain_console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]} %m%n

appender.json_console.type = Console
appender.json_console.name = json_console
appender.json_console.layout.type = JSONLayout
appender.json_console.layout.compact = true
appender.json_console.layout.eventEol = true

appender.rolling.type = RollingFile
appender.rolling.name = plain_rolling
appender.rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
appender.rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
appender.rolling.policies.type = Policies
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.rolling.policies.time.interval = 1
appender.rolling.policies.time.modulate = true
appender.rolling.layout.type = PatternLayout
appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %-.10000m%n

appender.json_rolling.type = RollingFile
appender.json_rolling.name = json_rolling
appender.json_rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
appender.json_rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}.log
appender.json_rolling.policies.type = Policies
appender.json_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.json_rolling.policies.time.interval = 1
appender.json_rolling.policies.time.modulate = true
appender.json_rolling.layout.type = JSONLayout
appender.json_rolling.layout.compact = true
appender.json_rolling.layout.eventEol = true

rootLogger.level = ${sys:ls.log.level}
rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console
rootLogger.appenderRef.rolling.ref = ${sys:ls.log.format}_rolling

```

and added following two line in to /etc/systemd/system/logstash.service file.

```auto
StandardOutput=null

```

But I do not want to change this file.  
is there any other way?

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 4, 2021, 1:50pm UTC](https://discuss.elastic.co/t/logstash-logging-problem/280329/3 "2021-08-04T13:50:53Z")

</div>

Anyone? might have done this

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2021, 1:51pm UTC](https://discuss.elastic.co/t/logstash-logging-problem/280329/4 "2021-09-01T13:51:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.