All Logstash errors logs in /var/log/logstash/* , but all the error logs of Logstash logs in /var/log/syslog too. Is there any way to disable logging errors of Logstash in /var/log/syslog?
2 Answers
1
votes
I suppose you run logstash from systemd. For unknown reason logstash print it's logs on stdout/stderr, so journald is forwarding console output to syslog. Redirect stdout/err in systemd unit file like this:
[Service]
Type=simple
Restart=always
WorkingDirectory=/data/logstash
ExecStart=/usr/bin/sudo -u logstashuser bash -c "/opt/logstash/bin/logstash --path.settings /opt/logstash/conf >/dev/null 2>/logs/logstash/logstash.error.log"
then
systemctl daemon-reload
and
systemctl stop logstash.service
systemctl start logstash.service
1
votes
Another solution is to modify /etc/systemd/system/logstash.service
and change those two option as following
StandardOutput=null
StandardError=null
# cat /etc/systemd/system/logstash.service
[Unit]
Description=logstash
[Service]
Type=simple
User=logstash
Group=logstash
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
StandardOutput=null
StandardError=null
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384
# When stopping, how long to wait before giving up and sending SIGKILL?
# Keep in mind that SIGKILL on a process can cause data loss.
TimeoutStopSec=infinity
[Install]
WantedBy=multi-user.target
Then of course
#systemctl daemon-reload
#systemctl restart logstash