can't find the way to change default location for logstash log file. Thanks.
In the end Logstash logs to the file passed to it via the -l/--log option. Depending on how you run Logstash there are different ways of affecting the command line. For RPM/Debian setups you'll want to adjust /etc/sysconfig/logstash or /etc/default/logstash.
I have both cases - in some it is run as service (sudo root available) - and in other I am running it from non-root account - not as a service but as nohup process ... SO for service the sysconfig file seems to exist on my RHEL 7 so that would be a place to setup it up/change it; For nohup option I would presume all goes out to output file for the nohup process?
Why would you run Logstash via nohup?
For nohup option I would presume all goes out to output file for the nohup process?
Yes. Unless, as I said, the -l/--log option is passed.
.. using nohup in VMs where there is no sudo root access available / hard to get ...
I get it - thank you Magnus.