# Logstash Logging to /var/log/messages
**URL:** https://discuss.elastic.co/t/logstash-logging-to-var-log-messages/186085
**Category:** Logstash
**Created:** [June 17, 2019, 2:15pm UTC](https://discuss.elastic.co/t/logstash-logging-to-var-log-messages/186085 "2019-06-17T14:15:52Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@DougR](https://discuss.elastic.co/u/DougR)
#### Post date: [June 17, 2019, 2:15pm UTC](https://discuss.elastic.co/t/logstash-logging-to-var-log-messages/186085/1 "2019-06-17T14:15:52Z")
Logstash is logging a duplicate of all data being logged to `/var/log/logstash/logstash-plain.log` to `/var/log/messages`. It appears that many others have experienced the same issue, and that the culprit is often the following line in the output section of the `*.conf` file:
```
stdout { codec => rubydebug }
```
However, I do not have this line in my `*.conf` file.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 17, 2019, 2:48pm UTC](https://discuss.elastic.co/t/logstash-logging-to-var-log-messages/186085/2 "2019-06-17T14:48:49Z")
logstash does not log to /var/log/message, it writes to stdout and it logs to /var/log/logstash. If you are running logstash as a service and you have your service manager configured to cc the stdout of a service to /var/log/messages than your service manager will write to /var/log/messages. The solution is to reconfigure the service manager.
---
### Author:  [@DougR](https://discuss.elastic.co/u/DougR)
#### Post date: [June 19, 2019, 4:52pm UTC](https://discuss.elastic.co/t/logstash-logging-to-var-log-messages/186085/3 "2019-06-19T16:52:23Z")
> [@Badger](#):
>
> logstash does not log to /var/log/message, it writes to stdout and it logs to /var/log/logstash. If you are running logstash as a service and you have your service manager configured to cc the stdout of a service to /var/log/messages than your service manager will write to /var/log/messages. The solution is to reconfigure the service manager.
While you are certainly correct, in practice amounts to the same thing. Additionally, reconfiguring the service manager was not an option, as other services on the host may rely on that functionality from the service manager to write their log entries to `/var/log/messages`.
Once I realized what was happening, I able to resolve the issue by commenting out the following lines in `log4j2.properties` and restarting logstash:
```
rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console
logger.slowlog.appenderRef.console_slowlog.ref = ${sys:ls.log.format}_console_slowlog
```
I located and commented out the corresponding lines for Elasticsearch, as well.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 17, 2019, 4:52pm UTC](https://discuss.elastic.co/t/logstash-logging-to-var-log-messages/186085/4 "2019-07-17T16:52:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.