When running Logstash 5 as a service, error output cannot be found at first glance. A users' first instinct is to check /var/log/logstash/, as this is historical behaviour, finding logstash-plain.log that contains only a partial story of Logstash's behaviour. E.g., in a situation where logstash won't start due to ruby syntax errors, logstash-plain.log appears to just start logstash over and over again like so:
[2016-12-05T12:28:34,702][INFO ][logstash.inputs.tcp ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:28:34,796][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2016-12-05T12:28:54,521][INFO ][logstash.inputs.tcp ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:28:54,590][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2016-12-05T12:29:20,872][INFO ][logstash.inputs.tcp ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:29:20,965][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
For the real story, under upstart the log appears in /var/log/upstart/logstash.log by default, and in systemd under journalctl -u logstash.service
While interesting and educational, also might be annoying.
When running Logstash 5 as a service, error output cannot be found at first glance. A users' first instinct is to check
/var/log/logstash/
, as this is historical behaviour, findinglogstash-plain.log
that contains only a partial story of Logstash's behaviour. E.g., in a situation where logstash won't start due to ruby syntax errors,logstash-plain.log
appears to just start logstash over and over again like so:For the real story, under upstart the log appears in
/var/log/upstart/logstash.log
by default, and in systemd underjournalctl -u logstash.service
While interesting and educational, also might be annoying.