# Prevent Logstash Service logging to /var/log/messages

**URL:** <https://discuss.elastic.co/t/prevent-logstash-service-logging-to-var-log-messages/181836>\
**Category:** Logstash\
**Created:** [May 20, 2019, 1:44pm UTC](https://discuss.elastic.co/t/prevent-logstash-service-logging-to-var-log-messages/181836 "2019-05-20T13:44:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anshul27jain](https://avatars.discourse-cdn.com/v4/letter/a/df788c/32.png) [@anshul27jain](https://discuss.elastic.co/u/anshul27jain)\
**Post date:** [May 20, 2019, 1:44pm UTC](https://discuss.elastic.co/t/prevent-logstash-service-logging-to-var-log-messages/181836/1 "2019-05-20T13:44:53Z")

</div>

Anyone please guide me in preventing Logstash logging to /var/log/messages?  
I have configured Syslog Input module on my server & sending those logs to Elasticsearch. Along with that all log related to logsatsh is also getting sent to Elasticsearch (which is not required & dirtying my Elasticsearch documents.

Same issue was raised earlier also but no solution was provided to it.

> [@Prevent Logstash logging to /var/log/messages](https://discuss.elastic.co/t/prevent-logstash-logging-to-var-log-messages/105372):
>
> Hi, Could you please guide me how to prevent Logstash logging to /var/log/messages? Thanks.

Below logs are coming to my /var/log/messages & i want to ignore it.

> May 20 15:41:01 logstash: "svc\_name" =\> "noise",  
> May 20 15:41:01 logstash: "message" =\> "May 20 15:40:59 MyServer logstash: ],",  
> May 20 15:41:01 logstash: "@timestamp" =\> 2019-05-20T13:41:00.667Z,  
> May 20 15:41:01 logstash: "syslog\_severity\_code" =\> 5,  
> May 20 15:41:01 logstash: "msg" =\> "logstash: ],",  
> May 20 15:41:01 logstash: "tags" =\> [  
> May 20 15:41:01 logstash: [0] "\_grokparsefailure"  
> May 20 15:41:01 logstash: ],  
> May 20 15:41:01 logstash: "epoc" =\> 1558359660,  
> May 20 15:41:01 logstash: "syslog\_hostname" =\> "MyServer",  
> May 20 15:41:01 logstash: "syslog\_timestamp" =\> "May 20 15:40:59",  
> May 20 15:41:01 logstash: "podname" =\> "vms"  
> May 20 15:41:01 systemd: Started Session 148663 of user root.  
> May 20 15:41:01 logstash: }  
> May 20 15:41:01 logstash: {  
> May 20 15:41:01 logstash: "svc\_name" =\> "noise",  
> May 20 15:41:01 systemd: Starting Session 148663 of user root.  
> May 20 15:41:01 logstash: "message" =\> "May 20 15:40:59 MyServer logstash: "epoc" =\> 1558359659,",  
> May 20 15:41:01 logstash: "@timestamp" =\> 2019-05-20T13:41:00.667Z,

I have already set Log Level in Warning state in logstash.yml file.  
log.level: warn

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 20, 2019, 2:09pm UTC](https://discuss.elastic.co/t/prevent-logstash-service-logging-to-var-log-messages/181836/2 "2019-05-20T14:09:40Z")

</div>

logstash logs to stdout. Your service manager may cc the stdout of a service to /var/log/messages.

---

<div class="post-metadata">

**Author:** ![anshul27jain](https://avatars.discourse-cdn.com/v4/letter/a/df788c/32.png) [@anshul27jain](https://discuss.elastic.co/u/anshul27jain)\
**Post date:** [May 23, 2019, 10:35am UTC](https://discuss.elastic.co/t/prevent-logstash-service-logging-to-var-log-messages/181836/3 "2019-05-23T10:35:56Z")

</div>

Removing below output in conf.d file, i was able to deny logstash related log coming to /var/log/messages

stdout { codec =\> rubydebug }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2019, 10:35am UTC](https://discuss.elastic.co/t/prevent-logstash-service-logging-to-var-log-messages/181836/4 "2019-06-20T10:35:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.