# Prevent Logstash logging to /var/log/messages
**URL:** https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372
**Category:** Logstash
**Created:** [October 26, 2017, 8:40am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372 "2017-10-26T08:40:59Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@pavuk](https://discuss.elastic.co/u/pavuk)
#### Post date: [October 26, 2017, 8:40am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/1 "2017-10-26T08:40:59Z")
Hi,
Could you please guide me how to prevent Logstash logging to /var/log/messages?
Thanks.
---
### Author:  [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [October 26, 2017, 8:47am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/2 "2017-10-26T08:47:25Z")
Hi @pavuk
that can be changed in the logstash.yml file
/etc/logstash/logstash.yml
at the bottom 🙂
```
# ------------ Debugging Settings --------------
#
# Options for log.level:
# * fatal
# * error
# * warn
# * info (default)
# * debug
# * trace
#
# log.level: info
path.logs: /var/log/logstash
#
```
hope that helps
---
### Author:  [@pavuk](https://discuss.elastic.co/u/pavuk)
#### Post date: [October 26, 2017, 8:52am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/3 "2017-10-26T08:52:16Z")
@lueneburger Thank you. But I have exactly the same lines at the bottom of logstash.yml file. And with
tail -f /var/log/messages
I see endless records like
.......
Oct 26 08:48:07 talk logstash: ],
Oct 26 08:48:07 talk logstash: "@timestamp" =\> 2017-10-26T08:48:07.000Z,
Oct 26 08:48:07 talk logstash: "build" =\> "",
Oct 26 08:48:07 talk logstash: "response" =\> 200,
Oct 26 08:48:07 talk logstash: "bytes" =\> 70084,
Oct 26 08:48:07 talk logstash: "name" =\> "Chrome",
Oct 26 08:48:07 talk logstash: "os\_name" =\> "Windows 7",
Oct 26 08:48:07 talk logstash: "httpversion" =\> [
Oct 26 08:48:07 talk logstash: [0] "1.0",
Oct 26 08:48:07 talk logstash: [1] "1.0"
Oct 26 08:48:07 talk logstash: ],
Oct 26 08:48:07 talk logstash: "device" =\> "Other"
Oct 26 08:48:07 talk logstash: }
Oct 26 08:48:07 talk logstash: {
Oct 26 08:48:07 talk logstash: "request" =\> [
.........
My /var/log/messages is really huge!
---
### Author:  [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [October 26, 2017, 9:00am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/4 "2017-10-26T09:00:19Z")
Hi @pavuk,
looks like you got a stdout in your logstash output section? 🙂
something like that:
`stdout { codec => rubydebug }`
---
### Author:  [@pavuk](https://discuss.elastic.co/u/pavuk)
#### Post date: [October 26, 2017, 9:01am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/5 "2017-10-26T09:01:41Z")
Yes, I have it in output. What should I do with it? 🙂
---
### Author:  [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [October 26, 2017, 9:03am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/6 "2017-10-26T09:03:30Z")
😃
disable it and see if the log stops growing
---
### Author:  [@pavuk](https://discuss.elastic.co/u/pavuk)
#### Post date: [October 26, 2017, 9:09am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/7 "2017-10-26T09:09:48Z")
Still no luck. Now I have
```
output {
elasticsearch {
hosts => ["http://xxxxx.com:9200/"]
index => "logstash-logs_%{+YYYY.MM.dd}"
document_type => "nginx_logs"
}
# stdout { codec => rubydebug }
}
```
restarted logstash sevice and still see logstash output in /var/log/messages ☹
---
### Author:  [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [October 26, 2017, 9:26am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/8 "2017-10-26T09:26:08Z")
Hi @pavuk,
ah ok, im using ubuntu and it's disabled by default.
just take a look for filter/disable the audit logs
etc/rsyslog.d/50-default.conf
```
#*.=info;*.=notice;*.=warn;\
# auth,authpriv.none;\
# cron,daemon.none;\
# mail,news.none -/var/log/messages
```
---
### Author:  [@pavuk](https://discuss.elastic.co/u/pavuk)
#### Post date: [October 26, 2017, 9:32am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/9 "2017-10-26T09:32:27Z")
Hmmm... I'm on CentOS7 and I have line
`*.info;mail.none;authpriv.none;cron.none /var/log/messages`
in /etc/rsyslog.conf
But it is server-wide setting. But I'd like to disable only logstash logging to /var/log/messages
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2017, 9:32am UTC](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372/10 "2017-11-23T09:32:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.