# Why does /var/log/logstash\_flow\_stats.log appear by default in RPM installation?

**URL:** https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321
**Category:** Logstash
**Created:** [March 3, 2026, 10:31am UTC](https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321 "2026-03-03T10:31:00Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![kuroro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kuroro/32/143492_2.png) [@kuroro](https://discuss.elastic.co/u/kuroro)
#### Post date: [March 3, 2026, 10:31am UTC](https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321/1 "2026-03-03T10:31:00Z")

</div>

Hi everyone,

I’m running Logstash 8.17.6 installed via RPM, with Stack Monitoring enabled (`xpack.monitoring.enabled: true`). I noticed that a file named:

```auto
/var/log/logstash_flow_stats.log

```

is created automatically.

Based on my current understanding, this happens because:

- In an RPM-based installation, Logstash starts an internal Flow Stats monitoring logger by default.

- This internal logger writes pipeline flow metrics to a dedicated file.

- This behavior appears to be enabled internally at startup.

- It does not seem to be controlled by a standard setting in `logstash.yml`.

- There is no dedicated configuration option in the official documentation specifically for `logstash_flow_stats.log`.

So my current assumption is:

Logstash writes flow metrics to `/var/log/logstash_flow_stats.log` (under the default `path.logs` directory) using an internal logger mechanism. This output does not appear to be directly controlled by `pipeline.metrics.log_level` or the general logging configuration options in `logstash.yml`.

* * *

### My Questions

1. Is this understanding correct?

2. Is this behavior documented somewhere officially?

3. Is this file generated by a specific Log4j2 logger (e.g., `logstash.metrics.flowstats`), or by some internal reporter mechanism?

4. What is the recommended way to verify the exact source of this file?

5. If I want to change its location (without disabling Stack Monitoring), what is the supported approach?

Any clarification from the Elastic team or community would be greatly appreciated.

Thank you!

---

<div class="post-metadata">

### Author: ![kuroro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kuroro/32/143492_2.png) [@kuroro](https://discuss.elastic.co/u/kuroro)
#### Post date: [March 5, 2026, 2:16am UTC](https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321/2 "2026-03-05T02:16:31Z")

</div>

Hi Folks，

please disregard with this case.

I found this is caused by a running cron job, it’s not a part of logstash.