Why does Logstash write its logstash-plain.log to ES?

Question

logstash

Hello!

Why does Logstash write its logstash-plain.log to ES even though it's not listed anywhere? Here is the input section:

input {
  beats {
    port => 5044
  }
}

And Filebeat has only one input:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/ ... /storage/logs/laravel*.log

Why does this happen and how to get rid of it?

The Logstash log turns out to be in the elastic index. output section:

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  }
}

Answer 1

Why does Logstash write its logstash-plain.log to ES?

Where does logstash-plain.log write to? In /var/log/logstash/logstash-plain.log? So is it normal, logstash is the software that writes the logs, or does it write to your elastic index? Then give an example, and you need to look at the output in this case.