On Jessie, elasticsearch is started by systemd, which captures console output and sends it to journald. This means that logs are duplicated between /var/log/elasticsearch and syslog / deamon.log.
The log4j configuration should be adapted to log only startup messages or critical messages to console and keep the rest only in the standard elasticsearch logs.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| elasticsearch: don't send logs to the console | operations/puppet | production | +1 -13 |
Change 338998 had a related patch set uploaded (by Gehel):
WIP - elasticsearch: only send minimal logging to console
After discussion with @dcausse, it seems to be a better idea to not send any logs to the console, so as to not mislead people into reading only part of the logs.
Mentioned in SAL (#wikimedia-operations) [2017-02-23T13:52:17Z] <gehel> restart logstash on relforge1001 to test logging configuration - T158664