# Lostash std err and out file oversize

**URL:** <https://discuss.elastic.co/t/lostash-std-err-and-out-file-oversize/230297>\
**Category:** Logstash\
**Created:** [April 29, 2020, 4:34am UTC](https://discuss.elastic.co/t/lostash-std-err-and-out-file-oversize/230297 "2020-04-29T04:34:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kopilim96](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopilim96/32/63260_2.png) [@kopilim96](https://discuss.elastic.co/u/kopilim96)\
**Post date:** [April 29, 2020, 4:34am UTC](https://discuss.elastic.co/t/lostash-std-err-and-out-file-oversize/230297/1 "2020-04-29T04:34:00Z")

</div>

Hi all, one of my colleagues called me yesterday and I was told that there are 2 logfile from Logstash are growing oversize, screenshot as below:

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c9cc13dbdb66d6b48d80b0d9b08ba41b79e23d63.png)

So the scenario is I am running 2 logstash as background services 24/7 since last month and it is weird for the logfile (as the pictures shown) having so much size.

So the message from the files logstash-stdout.log is basically the log input where the log is coming from another services named Nagios and I wonder why it doesn't do the log rotation like hitting certain size it will delete or the kind of log management.

However, message from another file named logstash-stderr.log is receiving this message all the time `Could not load : no implicit conversion of nil into String`

So in short, I would like to solve the oversize issue and btw what does `Could not load : no implicit conversion of nil into String` mean and how could it happened ?

Below is what I have write in the files.

`Logstash1.conf`

```auto
input {
  file {
    path => ["/usr/local/nagios/var/nagios.log"]
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}
filter{
//Filtering
}
output {
  elasticsearch {
    hosts => ["<IP_ADDRESS>"]
    index => "test-nagios"
  }
  stdout { codec => rubydebug }
}

```

`Logstash2.conf`

```auto
input {
  udp {
    port => 514
  }
}
filter {
//do ntg here
}
output {
  elasticsearch {
    hosts => ["<IP_ADDRESS>"]
    index => "get-tcp-1"
  }
  stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 29, 2020, 1:35pm UTC](https://discuss.elastic.co/t/lostash-std-err-and-out-file-oversize/230297/2 "2020-04-29T13:35:32Z")

</div>

logstash logs using log4j2, and the default log4j2.properties does not log to those files. I would guess that your service manager is cc'ing stdout and stderr to those files. To stop that, or to enable file rotation would require you to reconfigure your service manager. It is not a logstash question.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2020, 1:35pm UTC](https://discuss.elastic.co/t/lostash-std-err-and-out-file-oversize/230297/3 "2020-05-27T13:35:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.