title: Logstash creates enormous local log files and (although it sends then to Elasticsearch)
body: <h1>The problem</h1>
  
  <p>I have a machine with logstash on it, and another Elasticsearch-Kibana machine which stores the logs written from logstash on the first machine. Naturally, I want no logs to be kept on the origin machine and handle logging only on the Elasticsearch cluster.</p>
  
  <p>Unfortunately, logstash creates huge log files on the first machine (where nothing should be kept):</p>
  
  <p><a href="https://i.stack.imgur.com/hbkm1.png" rel="noreferrer"><img src="https://i.stack.imgur.com/hbkm1.png" alt="enter image description here"></a></p>
  
  <h1>The configuration</h1>
  
  <p>I have only one file under <code>/etc/logstash</code> on the origin machine, and as far as I can see, the configuration does not specify a local output:</p>
  
  <pre class="lang-ruby prettyprint-override"><code>input {
          tcp {
                  port =&gt; 5959
                  codec =&gt; json
          }
          udp {
                  port =&gt; 5959
          }
  }
  filter{
      json{
          source =&gt; "message"
      }
  }
  filter{
          if [@message] == "Incoming Event" {
              mutate{
                      add_field =&gt; {
                                "location" =&gt;  "%{@fields[location]}"
                          }
                  }
          }
  }
  output {
          elasticsearch {
                  # The host in which elasticsearch and Kibana live
                  host =&gt; "some.internal.aws.ip" 
          }
  }
  </code></pre>
  
  <p><strong>How can I stop logstash from writing local logs by configuration? I know I can cron-del them, but I think that prevention is less error-prone.</strong></p>