Logstash not logging

[timmy8ken (Tim Aitken)]

Hello,

I have Logstash 5.2.0 running on a Server 2016 server and I am trying to enable internal logging and I can't get it to write to a log file.

I have tried the following:

Edited logstash.yml with the following line:
path.logs: E:\ElasticStack\Logstash\logs\

Ran the following commands from command prompt:

logstash -f config\logstash-test.conf --path.log "E:\ElasticStack\Logstash\logs\logstash.log" --config.reload.automatic
logstash -f config\logstash-test.conf -l "%LS_HOME%\logs\logstash.log" --config.reload.automatic
logstash -f config\logstash-test.conf --path.log "E:\ElasticStack\Logstash\logs\" --config.reload.automatic
logstash -f config\logstash-test.conf -l "%LS_HOME%\logs\" --config.reload.automatic
logstash -f config\logstash-test.conf --path.log "E:\ElasticStack\Logstash\logs\logstash.log" --config.reload.automatic
logstash -f config\logstash-test.conf --path.log "E:\ElasticStack\Logstash\logs\" --config.reload.automatic
logstash -f config\logstash-test.conf --path.logs:E:\ElasticStack\Logstash\logs\ --config.reload.automatic
logstash -f config\logstash-test.conf --path.logs:E:\ElasticStack\Logstash\logs\logstash.log --config.reload.automatic

None of these end up with Logstash writing to a log file. The last three commands return the following errors:

ERROR: Unrecognised option '--path.logs:E:\ElasticStack\Logstash\logs\logstash.log'

If I increase the log level (--log.level debug) then I can see all the dubug info, which is what I need, but I can't read it because there is too much, hence the reason I want it to go to a log file.

Can anyone see what I may be doing wrong?

Cheers,

Tim

[msimos (Mike Simos)]

Hi,

Can you try using:

path.logs: "E:\\ElasticStack\\Logstash\\logs"

In your logstash.yml.

[timmy8ken (Tim Aitken)]

Hi Mike,

I've tested that format and there was not difference, still no logs created.

Whilst at it I also tried the following:

path.logs: "E:\\ElasticStack\\Logstash\\logs\\"
path.logs: "E:\\ElasticStack\\Logstash\\logs\\logstash.log"
path.logs: 'E:\\ElasticStack\\Logstash\\logs'

and for fun, on the command line:

logstash -f config\logstash.conf --path.logs E:\\ElasticStack\\Logstash\\logs\\ --config.reload.automatic

All of these configurations allowed Logstash to start, however no log files.

Tim

[msimos (Mike Simos)]

Try adding:

SET JAVA_OPTS=%JAVA_OPTS% -Dlog4j.configurationFile=%LS_HOME%\config\log4j2.properties

to bin\setup.bat in the Logstash directory. Refer to:

Issue: Unable to find log4j2.properties on windows

logstash cannot find log4j2.properties file

[timmy8ken (Tim Aitken)]

Thanks Mike,

That got me there in the end.

Adding the Java option got the log4j plugin working. The following command started Logstash and created logs:

logstash -f config\logstash.conf --path.logs /E:/ElasticStack/Logstash/logs/ --config.reload.automatic

I couldn't get logging working for the service, however it turned out I had the LS_SETTINGS_DIR environment variable set incorrectly. I had read INFO: Windows, Logstash and could not find log4j2 configuration which suggested using the unix style for the path. I changed it to a Windows style and it picked up the logstash.yml config.

The configuration setting I used in the yml file was:

path.logs: "//E://ElasticStack//Logstash//logs"

Thanks for your help with this.

Tim