Why does /var/log/logstash_flow_stats.log appear by default in RPM installation?

Elastic Stack Logstash
1

Hi everyone,

I’m running Logstash 8.17.6 installed via RPM, with Stack Monitoring enabled (xpack.monitoring.enabled: true). I noticed that a file named:

/var/log/logstash_flow_stats.log

is created automatically.

Based on my current understanding, this happens because:

  • In an RPM-based installation, Logstash starts an internal Flow Stats monitoring logger by default.

  • This internal logger writes pipeline flow metrics to a dedicated file.

  • This behavior appears to be enabled internally at startup.

  • It does not seem to be controlled by a standard setting in logstash.yml.

  • There is no dedicated configuration option in the official documentation specifically for logstash_flow_stats.log.

So my current assumption is:

Logstash writes flow metrics to /var/log/logstash_flow_stats.log (under the default path.logs directory) using an internal logger mechanism. This output does not appear to be directly controlled by pipeline.metrics.log_level or the general logging configuration options in logstash.yml.

My Questions

  1. Is this understanding correct?

  2. Is this behavior documented somewhere officially?

  3. Is this file generated by a specific Log4j2 logger (e.g., logstash.metrics.flowstats), or by some internal reporter mechanism?

  4. What is the recommended way to verify the exact source of this file?

  5. If I want to change its location (without disabling Stack Monitoring), what is the supported approach?

Any clarification from the Elastic team or community would be greatly appreciated.

Thank you!

2

Hi Folks，

please disregard with this case.

I found this is caused by a running cron job, it’s not a part of logstash.