Search code examples
logstashsyslogrsyslog

How to Disable logstash error logging in syslog

All Logstash errors logs in /var/log/logstash/* , but all the error logs of Logstash logs in /var/log/syslog too. Is there any way to disable logging errors of Logstash in /var/log/syslog?

Solution

  • I suppose you run logstash from systemd. For unknown reason logstash print it's logs on stdout/stderr, so journald is forwarding console output to syslog. Redirect stdout/err in systemd unit file like this:

    [Service]
Type=simple
Restart=always
WorkingDirectory=/data/logstash
ExecStart=/usr/bin/sudo -u logstashuser bash -c "/opt/logstash/bin/logstash --path.settings /opt/logstash/conf >/dev/null 2>/logs/logstash/logstash.error.log"

    then

    systemctl daemon-reload

    and

    systemctl stop logstash.service
systemctl start logstash.service