# Logstash output going to syslog

**URL:** <https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603>\
**Category:** Logstash\
**Created:** [August 30, 2018, 3:47am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603 "2018-08-30T03:47:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![lemont](https://avatars.discourse-cdn.com/v4/letter/l/7cd45c/32.png) [@lemont](https://discuss.elastic.co/u/lemont)\
**Post date:** [August 30, 2018, 3:47am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603/1 "2018-08-30T03:47:11Z")

</div>

Outputs from logstash somehow are going to the linux syslog file eating into the storage. I will have to delete the syslog file periodically.

How do I stop logstash output from sending to syslog?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 30, 2018, 5:47am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603/2 "2018-08-30T05:47:30Z")

</div>

What does your config look like?

---

<div class="post-metadata">

**Author:** ![lemont](https://avatars.discourse-cdn.com/v4/letter/l/7cd45c/32.png) [@lemont](https://discuss.elastic.co/u/lemont)\
**Post date:** [August 30, 2018, 6:37am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603/3 "2018-08-30T06:37:17Z")

</div>

All my logstash pipeline output is logged to the syslog file.  
Below is the output config of all my pipelines. Are there any logstash configurations that will cause this?

output {  
if "\_grokparsefailure" not in [tags] {  
elasticsearch {  
hosts =\> "10.xx.xx.xx"  
user =\> xxxxx  
password =\> xxxxxx  
index =\> "xxxx-%{+YYYY.MM}"  
}  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 30, 2018, 6:59am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603/4 "2018-08-30T06:59:38Z")

</div>

It it all events that are logged or just the ones with `_grokparsefailure`? What does the logged entries look like?

---

<div class="post-metadata">

**Author:** ![lemont](https://avatars.discourse-cdn.com/v4/letter/l/7cd45c/32.png) [@lemont](https://discuss.elastic.co/u/lemont)\
**Post date:** [August 31, 2018, 2:30am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603/5 "2018-08-31T02:30:24Z")

</div>

All events are logged, including the grokparsefailure ones, the logged entries syslog captured are after the logs being grokked.

---

<div class="post-metadata">

**Author:** ![lemont](https://avatars.discourse-cdn.com/v4/letter/l/7cd45c/32.png) [@lemont](https://discuss.elastic.co/u/lemont)\
**Post date:** [September 1, 2018, 11:34am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603/6 "2018-09-01T11:34:25Z")

</div>

Found the cause, one of the pipeline has stdout configured in its output.  
Issue resolved once I remove it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2018, 11:34am UTC](https://discuss.elastic.co/t/logstash-output-going-to-syslog/146603/7 "2018-09-29T11:34:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.