如何在syslog中禁用logstash错误日志记录

所有Logstash错误都记录在/var/log/Logstash/*中，但Logstash的所有错误日志也记录在/var/log/syslog中。

---

有没有办法在/var/log/syslog中禁用Logstash的日志错误？

我想您应该从systemd运行Logstash。由于未知原因，logstash将其日志打印在stdout/stderr上，因此journald将控制台输出转发给syslog。 在systemd单位文件中重定向标准输出/错误，如下所示：

[Service]
Type=simple
Restart=always
WorkingDirectory=/data/logstash
ExecStart=/usr/bin/sudo -u logstashuser bash -c "/opt/logstash/bin/logstash --path.settings /opt/logstash/conf >/dev/null 2>/logs/logstash/logstash.error.log"

然后

及

---

另一个解决方案是修改

/etc/systemd/system/logstash.service

，并更改这两个选项，如下所示

StandardOutput=null
StandardError=null

那当然

#systemctl daemon-reload
#systemctl restart logstash

StandardOutput=null
StandardError=null

# cat /etc/systemd/system/logstash.service
[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
StandardOutput=null
StandardError=null
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

# When stopping, how long to wait before giving up and sending SIGKILL?
# Keep in mind that SIGKILL on a process can cause data loss.
TimeoutStopSec=infinity

[Install]
WantedBy=multi-user.target

#systemctl daemon-reload
#systemctl restart logstash