# Logstash.stdout
**URL:** https://discuss.elastic.co/t/logstash-stdout/45152
**Category:** Logstash
**Created:** [March 22, 2016, 7:54pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152 "2016-03-22T19:54:17Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@pierrejnelson](https://discuss.elastic.co/u/pierrejnelson)
#### Post date: [March 22, 2016, 7:54pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152/1 "2016-03-22T19:54:17Z")
Would anyone happen to know what makes this file. I need to move it to where I have all my space but I can't seem to find it.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 22, 2016, 8:47pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152/2 "2016-03-22T20:47:26Z")
A correctly configured Logstash should produce a very small /var/log/logstash.stdout. Have a look in your init script. The init scripts that ship with Logstash's RPM and Debian packages lets the newly started Logstash daemon write to logstash.stdout until it switches over to its own log file.
---
### Author:  [@pierrejnelson](https://discuss.elastic.co/u/pierrejnelson)
#### Post date: [March 22, 2016, 9:45pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152/3 "2016-03-22T21:45:07Z")
I found where to change it at but this how big this has gotten in an hour
corp-netlog-live01:/data/log/logstash # ls -ltrh
total 1.7G
-rw-r--r-- 1 root root 0 Mar 22 15:40 logstash.err
-rw-r--r-- 1 logstash logstash 799K Mar 22 16:30 logstash.log
-rw-r--r-- 1 root root 1.7G Mar 22 16:44 logstash.stdout
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 22, 2016, 10:26pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152/4 "2016-03-22T22:26:58Z")
Have a look at it, what's in there?
---
### Author:  [@pierrejnelson](https://discuss.elastic.co/u/pierrejnelson)
#### Post date: [March 23, 2016, 12:31pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152/5 "2016-03-23T12:31:57Z")
corp-netlog-live01:/data/log/logstash # ls -ltrh
total 15G
-rw-r--r-- 1 root root 0 Mar 22 15:40 logstash.err
-rw-r--r-- 1 logstash logstash 3.0M Mar 23 07:22 logstash.log
-rw-r--r-- 1 root root 15G Mar 23 07:28 logstash.stdout
This is what I seen in there.
{
"message" =\> [
[0] "Mar 23 07:30:26 [xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx) %FWSM-6-303002: [xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx) Retrieved xxx.xxx.xxx.xxx20160221",
[1] " [xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx) Retrieved xxx.xxx.xxx.xxx:20160221"
],
"@version" =\> "1",
"@timestamp" =\> "2016-03-23T12:30:26.000Z",
"type" =\> "syslog",
"file" =\> "/var/log/remote/full-feed/full-feed.log",
"host" =\> "#########",
"offset" =\> "2733054399",
"timestamp" =\> "Mar 23 07:30:26",
"logsource" =\> "xx.xx.xx.xx",
"program" =\> "%FWSM-6-303002"
}
corp-netlog-live01:/data/log/logstash # tail -5 logstash.log
{:timestamp=\>"2016-03-23T07:32:51.525000-0500", :message=\>"retrying failed action with response code: 429", :level=\>:warn}
{:timestamp=\>"2016-03-23T07:32:51.526000-0500", :message=\>"retrying failed action with response code: 429", :level=\>:warn}
{:timestamp=\>"2016-03-23T07:32:51.526000-0500", :message=\>"retrying failed action with response code: 429", :level=\>:warn}
{:timestamp=\>"2016-03-23T07:32:51.527000-0500", :message=\>"retrying failed action with response code: 429", :level=\>:warn}
{:timestamp=\>"2016-03-23T07:32:51.527000-0500", :message=\>"retrying failed action with response code: 429", :level=\>:warn}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 23, 2016, 1:48pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152/6 "2016-03-23T13:48:25Z")
It looks like you have a `stdout { codec => rubydebug }` output in your configuration. Perhaps you should remove it.
---
### Author:  [@pierrejnelson](https://discuss.elastic.co/u/pierrejnelson)
#### Post date: [March 23, 2016, 1:51pm UTC](https://discuss.elastic.co/t/logstash-stdout/45152/7 "2016-03-23T13:51:03Z")
That fixed it
Sending logstash logs to /data/log/logstash/logstash.log.
Thank you so much for your help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/logstash-stdout/45152/8 "2017-07-06T05:05:41Z")