I am not able to find logstash-plain.log in the var/log/logstash directory. Configurations are set to write logs in /var/log/logstash directory. please advise.
Logstash missing logs issue
-
Permissions:
/var/log/logstash or logstash/logs are default log directories. /var/log/logstash is used in systemctl mode service, logstash/logs are when you use binaries from zip as a process. In the process mode, LS will be run as user which run it.
In the service mode, the default user is "logstash".The default "logstash" user must have permissions to /var/log/logstash, run:
chown -R logstash:logstash /var/log/logstash/ -
You can change logs path, set in logstash.yml
path.logs: /path/ls-dir
Another option is to change individually pathd in log4j2.propeties:
appender.rolling.fileName = ${sys:ls.logs}/logstash-plain.log
appender.json_rolling.fileName = ${sys:ls.logs}/logstash-json.log
...
Everything seems to be ok as you mentioned. Below is FYR. however I am not able to find plain logs only logstash-slowlog-json.log and their rotation files in the var/log/logstash directory.
Permissions.
drwxrwxr-x 2 logstash logstash 28K Nov 17 06:19 logstash
set in logstash.yml
logs: "/var/log/logstash"
log4j2.propeties:
appender.rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
appender.json_rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log
Maybe your LS is not fully started. Check journal.
How do you start as a process or service? Are you you that LS pick .conf file? Set log.level: debug in logstash.yml.
Also sometimes you have an issue when logstash user doesn't have permission on /tmp directory. Check here.
Service is functioning properly and having access to write tmp directory. We are getting json logs but no plain logs
Set log.format: plain in logstash.yml
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.