Logstash Directory Layout
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
This section describes the default directory structure that is created when you unpack the Logstash installation packages.
The .zip and .tar.gz packages are entirely self-contained. All files and directories are, by default, contained within the home directory — the directory created when unpacking the archive.
This is very convenient because you don’t have to create any directories to start using Logstash, and uninstalling Logstash is as easy as removing the home directory. However, it is advisable to change the default locations of the config and the logs directories so that you do not delete important data later on.
| Type | Description | Default Location | Setting |
|---|---|---|---|
| home | Home directory of the Logstash installation. | {extract.path}- Directory created by unpacking the archive |
|
| bin | Binary scripts, including logstash to start Logstash and logstash-plugin to install plugins |
{extract.path}/bin |
|
| settings | Configuration files, including logstash.yml and jvm.options |
{extract.path}/config |
path.settings |
| logs | Log files | {extract.path}/logs |
path.logs |
| plugins | Local, non Ruby-Gem plugin files. Each plugin is contained in a subdirectory. Recommended for development only. | {extract.path}/plugins |
path.plugins |
| data | Data files used by logstash and its plugins for any persistence needs. | {extract.path}/data |
path.data |
The Debian package and the RPM package each place config files, logs, and the settings files in the appropriate locations for the system:
| Type | Description | Default Location | Setting |
|---|---|---|---|
| home | Home directory of the Logstash installation. | /usr/share/logstash |
|
| bin | Binary scripts including logstash to start Logstash and logstash-plugin to install plugins |
/usr/share/logstash/bin |
|
| settings | Configuration files, including logstash.yml and jvm.options |
/etc/logstash |
path.settings |
| conf | Logstash pipeline configuration files | /etc/logstash/conf.d/*.conf |
See /etc/logstash/pipelines.yml |
| logs | Log files | /var/log/logstash |
path.logs |
| plugins | Local, non Ruby-Gem plugin files. Each plugin is contained in a subdirectory. Recommended for development only. | /usr/share/logstash/plugins |
path.plugins |
| data | Data files used by logstash and its plugins for any persistence needs. | /var/lib/logstash |
path.data |
The Docker images are created from the .tar.gz packages, and follow a similar directory layout.
| Type | Description | Default Location | Setting |
|---|---|---|---|
| home | Home directory of the Logstash installation. | /usr/share/logstash |
|
| bin | Binary scripts, including logstash to start Logstash and logstash-plugin to install plugins |
/usr/share/logstash/bin |
|
| settings | Configuration files, including logstash.yml and jvm.options |
/usr/share/logstash/config |
path.settings |
| conf | Logstash pipeline configuration files | /usr/share/logstash/pipeline |
path.config |
| plugins | Local, non Ruby-Gem plugin files. Each plugin is contained in a subdirectory. Recommended for development only. | /usr/share/logstash/plugins |
path.plugins |
| data | Data files used by logstash and its plugins for any persistence needs. | /usr/share/logstash/data |
path.data |
Logstash Docker containers do not create log files by default. They log to standard output.