# Logstash Logging

**URL:** <https://discuss.elastic.co/t/logstash-logging/92828>\
**Category:** Logstash\
**Created:** [July 12, 2017, 2:35pm UTC](https://discuss.elastic.co/t/logstash-logging/92828 "2017-07-12T14:35:11Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nitin\_gupta](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\
**Post date:** [July 12, 2017, 2:35pm UTC](https://discuss.elastic.co/t/logstash-logging/92828/1 "2017-07-12T14:35:11Z")

</div>

HI ,  
i am trying to enable logging in Logstash . i am using windows version on my desktop

**Start command**  
logstash.bat -f beats.conf --verbose

**logstash-5.3.1\config\logstash.yml**  
log.level: debug  
path.logs: C:\Users\Acme\Desktop\ELK\logs\logstash

but logging file is not creating . Please help

Regards  
nitin

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2017, 2:53pm UTC](https://discuss.elastic.co/t/logstash-logging/92828/2 "2017-07-12T14:53:10Z")

</div>

Is Logstash giving any clues in its console printouts? What if you bump the log level even further with `--debug`?

Did you try using forward slashes in the `path.logs` value or double quote the value?

---

<div class="post-metadata">

**Author:** ![Nitin\_gupta](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\
**Post date:** [July 12, 2017, 3:12pm UTC](https://discuss.elastic.co/t/logstash-logging/92828/3 "2017-07-12T15:12:07Z")

</div>

Thanks @magnusbaeck for replying

i tried with double quote and got an error in command line , then i tried with single quotes and was able to start logstash

with --debug option in start command  
i can see  
11:08:30.247 [LogStash::Runner] DEBUG logstash.runner - \*log.level: "debug" (default: "info")  
11:08:30.249 [LogStash::Runner] DEBUG logstash.runner - path.settings: "C:/Users/nitingupta/Desktop/ELK/logstash-5.3.1/config"  
11:08:30.249 [LogStash::Runner] DEBUG logstash.runner - \*path.logs: "C:\Users\nitingupta\Desktop\ELK\logs\logstash" (default: "C:/Users/nitingupta/Desktop/ELK/logstash-5.3.1/logs")

Also i can see API for logstash is enabled  
11:08:34.028 [Api Webserver] DEBUG logstash.agent - Trying to start WebServer {:port=\>9600}  
11:08:34.029 [Api Webserver] DEBUG logstash.api.service - [api-service] start  
11:08:34.123 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=\>9600}

but still log files are not generated

Regards  
nitin

---

<div class="post-metadata">

**Author:** ![Nitin\_gupta](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\
**Post date:** [July 12, 2017, 3:50pm UTC](https://discuss.elastic.co/t/logstash-logging/92828/4 "2017-07-12T15:50:18Z")

</div>

@magnusbaeck

there are warning to setup log4j

log4j:WARN No appenders could be found for logger (org.apache.http.client.protocol.RequestAuthCache).  
log4j:WARN Please initialize the log4j system properly.  
log4j:WARN See [http://logging.apache.org/log4j/1.2/faq.html#noconfig](http://logging.apache.org/log4j/1.2/faq.html#noconfig) for more info.

Is anything i need to configure ?

Thanks for your help 🙂

Regards  
nitin

---

<div class="post-metadata">

**Author:** ![kiranilla](https://avatars.discourse-cdn.com/v4/letter/k/8e7dd6/32.png) [@kiranilla](https://discuss.elastic.co/u/kiranilla)\
**Post date:** [July 18, 2017, 9:46am UTC](https://discuss.elastic.co/t/logstash-logging/92828/5 "2017-07-18T09:46:55Z")

</div>

Is there any possibility that we can split the logs in four different folder **or** four different files accordingly.

Eg : I have done the configuration like below in logstash.yml :

```
log.level: info
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\info
 log.level: warn
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\warn
 log.level: error
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\error
 log.level: debug
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\debug
 log.level: trace
 path.logs: C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\trace

```

So in the above case its not generating the files seperately in different folders for different log type, instead of its logging all the different types in one log file in the following path as shown below:

`C:\ELK\ELK5.4\ELK5.4Backup\logs\logstash\trace\logstash-plain.log`  
and other folders looks empty..

Could you please suggest how to achieve this (different logs files in different folders or different files.  
_ **As error should goes to the error folder with corresponding file name, debug should goes to debug folder with corresponding file name.** _  
Any additional configuration changes are required to achieve this..

Please suggest..  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 18, 2017, 9:58am UTC](https://discuss.elastic.co/t/logstash-logging/92828/6 "2017-07-18T09:58:35Z")

</div>

Yeah, what you've tried just won't work but you should be able to reach your goal by tweaking log4j2.properties. I suppose you'll need one appender per log level.

I don't understand why you want this, though.

---

<div class="post-metadata">

**Author:** ![kiranilla](https://avatars.discourse-cdn.com/v4/letter/k/8e7dd6/32.png) [@kiranilla](https://discuss.elastic.co/u/kiranilla)\
**Post date:** [July 18, 2017, 1:44pm UTC](https://discuss.elastic.co/t/logstash-logging/92828/7 "2017-07-18T13:44:27Z")

</div>

**Thanks Magnus....... for your response**

I got it want you said... but i would like to know/check that kind of option is available in logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2017, 1:44pm UTC](https://discuss.elastic.co/t/logstash-logging/92828/8 "2017-08-15T13:44:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
