# Not able to find logstash plain log in the var/log/logstash directory **URL:** \ **Category:** Logstash\ **Created:** [November 16, 2023, 9:23am UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296 "2023-11-16T09:23:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Domnic\_Raj\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/domnic_raj_d/32/126492_2.png) [@Domnic\_Raj\_D](https://discuss.elastic.co/u/Domnic_Raj_D)\ **Post date:** [November 16, 2023, 9:23am UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296/1 "2023-11-16T09:23:11Z")
I am not able to find logstash-plain.log in the var/log/logstash directory. Configurations are set to write logs in /var/log/logstash directory. please advise. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 16, 2023, 9:45pm UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296/2 "2023-11-16T21:45:06Z")
Logstash missing logs issue 1. Permissions: /var/log/logstash or logstash/logs are default log directories. /var/log/logstash is used in systemctl mode service, logstash/logs are when you use binaries from zip as a process. In the process mode, LS will be run as user which run it. In the service mode, the default user is "logstash".The default "logstash" user must have permissions to /var/log/logstash, run: `chown -R logstash:logstash /var/log/logstash/` 2. You can change logs path, set in logstash.yml `path.logs: /path/ls-dir` Another option is to change individually pathd in log4j2.propeties: `appender.rolling.fileName = ${sys:ls.logs}/logstash-plain.log` `appender.json_rolling.fileName = ${sys:ls.logs}/logstash-json.log` ... ---
**Author:** ![Domnic\_Raj\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/domnic_raj_d/32/126492_2.png) [@Domnic\_Raj\_D](https://discuss.elastic.co/u/Domnic_Raj_D)\ **Post date:** [November 17, 2023, 6:52am UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296/3 "2023-11-17T06:52:03Z")
Everything seems to be ok as you mentioned. Below is FYR. however I am not able to find plain logs only **logstash-slowlog-json.log** and their rotation files in the var/log/logstash directory. Permissions. drwxrwxr-x 2 logstash logstash 28K Nov 17 06:19 logstash set in logstash.yml logs: "/var/log/logstash" log4j2.propeties: appender.rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log appender.json\_rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 17, 2023, 9:01am UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296/4 "2023-11-17T09:01:58Z")
Maybe your LS is not fully started. Check journal. How do you start as a process or service? Are you you that LS pick .conf file? Set ` log.level: debug` in logstash.yml. Also sometimes you have an issue when logstash user doesn't have permission on /tmp directory. Check [here](https://github.com/elastic/logstash/issues/10714). ---
**Author:** ![Domnic\_Raj\_D](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/domnic_raj_d/32/126492_2.png) [@Domnic\_Raj\_D](https://discuss.elastic.co/u/Domnic_Raj_D)\ **Post date:** [November 17, 2023, 11:01am UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296/5 "2023-11-17T11:01:25Z")
Service is functioning properly and having access to write tmp directory. We are getting json logs but no plain logs ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [November 17, 2023, 6:44pm UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296/6 "2023-11-17T18:44:50Z")
Set `log.format: plain` in logstash.yml ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 15, 2023, 6:45pm UTC](https://discuss.elastic.co/t/not-able-to-find-logstash-plain-log-in-the-var-log-logstash-directory/347296/7 "2023-12-15T18:45:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.