# Logstash logging to messages
**URL:** https://discuss.elastic.co/t/logstash-logging-to-messages/164563
**Category:** Logstash
**Created:** [January 17, 2019, 2:15am UTC](https://discuss.elastic.co/t/logstash-logging-to-messages/164563 "2019-01-17T02:15:02Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@jplamadrid](https://discuss.elastic.co/u/jplamadrid)
#### Post date: [January 17, 2019, 2:15am UTC](https://discuss.elastic.co/t/logstash-logging-to-messages/164563/1 "2019-01-17T02:15:02Z")
Good day,
Just want to know how can I control the logstash logging to /var/messages.log in Centos 7? We integrated ELK with snort and keep on receiving these kind of logs:
```
Jan 13 03:39:04 hostname logstash: {
```
Jan 13 03:39:04 hostname logstash: "Rule\_SID" =\> 10000003,
Jan 13 03:39:04 hostname logstash: "host" =\> "",
Jan 13 03:39:04 hostname logstash: "path" =\> "/var/log/snort/alert",
Jan 13 03:39:04 hostname logstash: "time\_units" =\> "min",
Jan 13 03:39:04 hostname logstash: "time\_threshold" =\> "1",
Jan 13 03:39:04 hostname logstash: "Source\_Port" =\> 49691,
Jan 13 03:39:04 hostname logstash: "type" =\> "snort-alert",
Jan 13 03:39:04 hostname logstash: "hit\_threshold" =\> "200",
Jan 13 03:39:04 hostname logstash: "Destination\_Port" =\> 3071,
Jan 13 03:39:04 hostname logstash: "@timestamp" =\> 2019-01-12T19:39:03.873Z,
Jan 13 03:39:04 hostname logstash: "Rule\_Revision" =\> 1,
Jan 13 03:39:04 hostname logstash: "tags" =\> [
Jan 13 03:39:04 hostname logstash: [0] "throttled"
Jan 13 03:39:04 hostname logstash: ],
Jan 13 03:39:04 hostname logstash: "Timestamp" =\> 2019-01-12T19:39:03.118Z,
Jan 13 03:39:04 hostname logstash: "Rule\_GID" =\> 1,
Jan 13 03:39:04 hostname logstash: "Destination\_IP" =\> "",
Jan 13 03:39:04 hostname logstash: "Alert" =\> "UDP Test",
Jan 13 03:39:04 hostname logstash: "Priority" =\> 0,
Jan 13 03:39:04 hostname logstash: "Source\_IP" =\> "172.24.3.206",
Jan 13 03:39:04 hostname logstash: "@version" =\> "1",
Jan 13 03:39:04 hostname logstash: "Protocol" =\> "UDP",
Jan 13 03:39:04 hostname logstash: "message" =\> "01/13/19-03:39:03.118563 [**] [1:10000003:1] UDP Test [**] [Priority: 0] {UDP} "
Jan 13 03:39:04 logstash: }
ELK + Snort is also integrated with log server so it's kinda noisy. Please help, Thanks a lot!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2019, 2:15am UTC](https://discuss.elastic.co/t/logstash-logging-to-messages/164563/2 "2019-02-14T02:15:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.