Nagios Support Forum

Hello There,

logstash.log file is filling up pretty fast in our Nagios Log Server. I am seeing lot of grokparsefailure messages flowing in which I am suspecting could be a reason for this behavior.

How do I stop this until the grokparsefailure messages are taken care off.

Thank You,
SB

You can disable the logging by editing /etc/init.d/logstash and changing line 64:

DAEMON_OPTS="agent -f ${LS_CONF_DIR} -l ${LS_LOG_FILE} ${LS_OPTS}"

to:

DAEMON_OPTS="agent -f ${LS_CONF_DIR} ${LS_OPTS}"

Then restart the service:

systemctl daemon-reload
service logstash restart

@cdienger, This issue auto resolved, please close this topic.

If I see the issue occurring again, I will follow your steps and see if that resolves it.

Thank You.