Logstash Logging

[Nitin_gupta]

HI ,
i am trying to enable logging in Logstash . i am using windows version on my desktop

Start command
logstash.bat -f beats.conf --verbose

logstash-5.3.1\config\logstash.yml
log.level: debug
path.logs: C:\Users\Acme\Desktop\ELK\logs\logstash

but logging file is not creating . Please help

Regards
nitin

[magnusbaeck (Magnus Bäck)]

Is Logstash giving any clues in its console printouts? What if you bump the log level even further with --debug?

Did you try using forward slashes in the path.logs value or double quote the value?

[Nitin_gupta]

Thanks @magnusbaeck for replying

i tried with double quote and got an error in command line , then i tried with single quotes and was able to start logstash

with --debug option in start command
i can see
11:08:30.247 [LogStash::Runner] DEBUG logstash.runner - *log.level: "debug" (default: "info")
11:08:30.249 [LogStash::Runner] DEBUG logstash.runner - path.settings: "C:/Users/nitingupta/Desktop/ELK/logstash-5.3.1/config"
11:08:30.249 [LogStash::Runner] DEBUG logstash.runner - *path.logs: "C:\Users\nitingupta\Desktop\ELK\logs\logstash" (default: "C:/Users/nitingupta/Desktop/ELK/logstash-5.3.1/logs")

Also i can see API for logstash is enabled
11:08:34.028 [Api Webserver] DEBUG logstash.agent - Trying to start WebServer {:port=>9600}
11:08:34.029 [Api Webserver] DEBUG logstash.api.service - [api-service] start
11:08:34.123 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}

but still log files are not generated

Regards
nitin

[Nitin_gupta]

@magnusbaeck

there are warning to setup log4j

log4j:WARN No appenders could be found for logger (org.apache.http.client.protocol.RequestAuthCache).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.

Is anything i need to configure ?

Thanks for your help

Regards
nitin

[kiranilla (Kiran)]

Is there any possibility that we can split the logs in four different folder or four different files accordingly.

Eg : I have done the configuration like below in logstash.yml :

log.level: info
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\info
 log.level: warn
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\warn
 log.level: error
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\error
 log.level: debug
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\debug
 log.level: trace
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\trace

So in the above case its not generating the files seperately in different folders for different log type, instead of its logging all the different types in one log file in the following path as shown below:

C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\trace\logstash-plain.log
and other folders looks empty..

Could you please suggest how to achieve this (different logs files in different folders or different files.
As error should goes to the error folder with corresponding file name, debug should goes to debug folder with corresponding file name.
Any additional configuration changes are required to achieve this..

Please suggest..
Thanks in advance.

[magnusbaeck (Magnus Bäck)]

Yeah, what you've tried just won't work but you should be able to reach your goal by tweaking log4j2.properties. I suppose you'll need one appender per log level.

I don't understand why you want this, though.

[kiranilla (Kiran)]

Thanks Magnus....... for your response

I got it want you said... but i would like to know/check that kind of option is available in logstash.