diff --git a/CHANGELOG.md b/CHANGELOG.md
index eadd183..8c92779 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Which is based on [Keep A Changelog](http://keepachangelog.com/)
 ### Added
 
 - test: add support debian 12
+- feat: manage logging config
 
 ### Removed
 
diff --git a/README.md b/README.md
index 1a05a4f..c8bfd7d 100644
--- a/README.md
+++ b/README.md
@@ -56,7 +56,7 @@ Install and configure logstash
     }
 ```
 
-- `logstash_pattern` hash with grok patterns
+- `logstash_pattern` - hash with grok patterns
 
 ```
   postfix: |
@@ -66,6 +66,43 @@ Install and configure logstash
     POSTFIX (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{COMPID}:
 ```
 
+- `logstash_logging_config` - hash with logging config (log4j2)
+
+```yaml
+  status: "error"
+  name: "LogstashPropertiesConfig"
+  appender.rolling.type: "RollingFile"
+  appender.rolling.name: "plain_rolling"
+  appender.rolling.fileName: "${sys:ls.logs}/logstash-plain.log"
+  appender.rolling.filePattern: "${sys:ls.logs}/logstash-plain-%d{yyyy-MM-dd}-%i.log.gz"
+  appender.rolling.policies.type: "Policies"
+  appender.rolling.policies.time.type: "TimeBasedTriggeringPolicy"
+  appender.rolling.policies.time.interval: "1"
+  appender.rolling.policies.time.modulate: true
+  appender.rolling.layout.type: "PatternLayout"
+  appender.rolling.layout.pattern: "[%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n"
+  appender.rolling.policies.size.type: "SizeBasedTriggeringPolicy"
+  appender.rolling.policies.size.size: "100MB"
+  appender.rolling.strategy.type: "DefaultRolloverStrategy"
+  appender.rolling.strategy.max: 30
+  appender.rolling.avoid_pipelined_filter.type: "PipelineRoutingFilter"
+  appender.routing.type: "PipelineRouting"
+  appender.routing.name: "pipeline_routing_appender"
+  appender.routing.pipeline.type: "RollingFile"
+  appender.routing.pipeline.name: "appender-${ctx:pipeline.id}"
+  appender.routing.pipeline.fileName: "${sys:ls.logs}/pipeline_${ctx:pipeline.id}.log"
+  appender.routing.pipeline.filePattern: "${sys:ls.logs}/pipeline_${ctx:pipeline.id}.%i.log.gz"
+  appender.routing.pipeline.layout.type: "PatternLayout"
+  appender.routing.pipeline.layout.pattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+  appender.routing.pipeline.policy.type: "SizeBasedTriggeringPolicy"
+  appender.routing.pipeline.policy.size: "100MB"
+  appender.routing.pipeline.strategy.type: "DefaultRolloverStrategy"
+  appender.routing.pipeline.strategy.max: 30
+  rootLogger.level: "${sys:ls.log.level}"
+  rootLogger.appenderRef.rolling.ref: "${sys:ls.log.format}_rolling"
+  rootLogger.appenderRef.routing.ref: "pipeline_routing_appender"
+```
+
 ## How to use
 
 ```
diff --git a/defaults/main.yml b/defaults/main.yml
index 60ba473..0056d9f 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -10,3 +10,82 @@ logstash_inputs: []
 logstash_outputs: []
 logstash_filters: []
 logstash_patterns: {}
+logstash_logging_config: {}
+logstash_logging_default_config:
+  status: "error"
+  name: "LogstashPropertiesConfig"
+  appender.rolling.type: "RollingFile"
+  appender.rolling.name: "plain_rolling"
+  appender.rolling.fileName: "${sys:ls.logs}/logstash-plain.log"
+  appender.rolling.filePattern: "${sys:ls.logs}/logstash-plain-%d{yyyy-MM-dd}-%i.log.gz"
+  appender.rolling.policies.type: "Policies"
+  appender.rolling.policies.time.type: "TimeBasedTriggeringPolicy"
+  appender.rolling.policies.time.interval: "1"
+  appender.rolling.policies.time.modulate: true
+  appender.rolling.layout.type: "PatternLayout"
+  appender.rolling.layout.pattern: "[%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n"
+  appender.rolling.policies.size.type: "SizeBasedTriggeringPolicy"
+  appender.rolling.policies.size.size: "100MB"
+  appender.rolling.strategy.type: "DefaultRolloverStrategy"
+  appender.rolling.strategy.max: 30
+  appender.rolling.avoid_pipelined_filter.type: "PipelineRoutingFilter"
+  appender.routing.type: "PipelineRouting"
+  appender.routing.name: "pipeline_routing_appender"
+  appender.routing.pipeline.type: "RollingFile"
+  appender.routing.pipeline.name: "appender-${ctx:pipeline.id}"
+  appender.routing.pipeline.fileName: "${sys:ls.logs}/pipeline_${ctx:pipeline.id}.log"
+  appender.routing.pipeline.filePattern: "${sys:ls.logs}/pipeline_${ctx:pipeline.id}.%i.log.gz"
+  appender.routing.pipeline.layout.type: "PatternLayout"
+  appender.routing.pipeline.layout.pattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+  appender.routing.pipeline.policy.type: "SizeBasedTriggeringPolicy"
+  appender.routing.pipeline.policy.size: "100MB"
+  appender.routing.pipeline.strategy.type: "DefaultRolloverStrategy"
+  appender.routing.pipeline.strategy.max: 30
+  rootLogger.level: "${sys:ls.log.level}"
+  rootLogger.appenderRef.rolling.ref: "${sys:ls.log.format}_rolling"
+  rootLogger.appenderRef.routing.ref: "pipeline_routing_appender"
+  appender.rolling_slowlog.type: "RollingFile"
+  appender.rolling_slowlog.name: "plain_rolling_slowlog"
+  appender.rolling_slowlog.fileName: "${sys:ls.logs}/logstash-slowlog-plain.log"
+  appender.rolling_slowlog.filePattern: "${sys:ls.logs}/logstash-slowlog-plain-%d{yyyy-MM-dd}-%i.log.gz"
+  appender.rolling_slowlog.policies.type: "Policies"
+  appender.rolling_slowlog.policies.time.type: "TimeBasedTriggeringPolicy"
+  appender.rolling_slowlog.policies.time.interval: "1"
+  appender.rolling_slowlog.policies.time.modulate: true
+  appender.rolling_slowlog.layout.type: "PatternLayout"
+  appender.rolling_slowlog.layout.pattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+  appender.rolling_slowlog.policies.size.type: "SizeBasedTriggeringPolicy"
+  appender.rolling_slowlog.policies.size.size: "100MB"
+  appender.rolling_slowlog.strategy.type: "DefaultRolloverStrategy"
+  appender.rolling_slowlog.strategy.max: 30
+  logger.slowlog.name: "slowlog"
+  logger.slowlog.level: "trace"
+  logger.slowlog.appenderRef.rolling_slowlog.ref: "${sys:ls.log.format}_rolling_slowlog"
+  logger.slowlog.additivity: "false"
+  logger.licensereader.name: "logstash.licensechecker.licensereader"
+  logger.licensereader.level: "error"
+  logger.apache_http_client.name: "org.apache.http"
+  logger.apache_http_client.level: "fatal"
+  appender.deprecation_rolling.type: "RollingFile"
+  appender.deprecation_rolling.name: "deprecation_plain_rolling"
+  appender.deprecation_rolling.fileName: "${sys:ls.logs}/logstash-deprecation.log"
+  appender.deprecation_rolling.filePattern: "${sys:ls.logs}/logstash-deprecation-%d{yyyy-MM-dd}-%i.log.gz"
+  appender.deprecation_rolling.policies.type: "Policies"
+  appender.deprecation_rolling.policies.time.type: "TimeBasedTriggeringPolicy"
+  appender.deprecation_rolling.policies.time.interval: "1"
+  appender.deprecation_rolling.policies.time.modulate: true
+  appender.deprecation_rolling.layout.type: "PatternLayout"
+  appender.deprecation_rolling.layout.pattern: "[%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n"
+  appender.deprecation_rolling.policies.size.type: "SizeBasedTriggeringPolicy"
+  appender.deprecation_rolling.policies.size.size: "100MB"
+  appender.deprecation_rolling.strategy.type: "DefaultRolloverStrategy"
+  appender.deprecation_rolling.strategy.max: 30
+  logger.deprecation.name: "org.logstash.deprecation, deprecation"
+  logger.deprecation.level: "WARN"
+  logger.deprecation.appenderRef.deprecation_rolling.ref: "deprecation_plain_rolling"
+  logger.deprecation.additivity: "false"
+  logger.deprecation_root.name: "deprecation"
+  logger.deprecation_root.level: "WARN"
+  logger.deprecation_root.appenderRef.deprecation_rolling.ref: "deprecation_plain_rolling"
+  logger.deprecation_root.additivity: false
+logstash_logging_full_config: "{{ logstash_logging_default_config | combine(logstash_logging_config) }}"
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
index 808f5c2..471c90c 100644
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@@ -23,6 +23,9 @@
           path => "/tmp/logstash.log"
           codec => "json"
         }
+    logstash_logging_config:
+      appender.rolling.strategy.max: 15
+
   pre_tasks:
     - name: update apt cache
       ansible.builtin.apt:
diff --git a/molecule/default/tests/test_default.py b/molecule/default/tests/test_default.py
index 5e59039..582b5ce 100644
--- a/molecule/default/tests/test_default.py
+++ b/molecule/default/tests/test_default.py
@@ -13,6 +13,15 @@ def test_config_file(host):
   assert path.group == 'root'
   assert path.mode == 0o644
 
+def test_logging_config_file(host):
+  path = host.file('/etc/logstash/log4j2.properties')
+  assert path.exists
+  assert path.is_file
+  assert path.user == 'root'
+  assert path.group == 'root'
+  assert path.mode == 0o644
+  assert path.contains('appender.rolling.strategy.max = 15')
+
 def test_input_file(host):
   path = host.file('/etc/logstash/conf.d/input.conf')
   assert path.exists
diff --git a/tasks/main.yml b/tasks/main.yml
index 3703240..d0459ce 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -38,6 +38,16 @@
   notify: Restart logstash
   tags: logstash
 
+- name: Copy logging config file
+  ansible.builtin.template:
+    src: log4j2.properties.j2
+    dest: /etc/logstash/log4j2.properties
+    owner: root
+    group: root
+    mode: 0644
+  notify: Restart logstash
+  tags: logstash
+
 - name: Create patterns directory
   ansible.builtin.file:
     path: /etc/logstash/patterns
diff --git a/templates/log4j2.properties.j2 b/templates/log4j2.properties.j2
new file mode 100644
index 0000000..c4b3804
--- /dev/null
+++ b/templates/log4j2.properties.j2
@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+
+{% for key, value in logstash_logging_full_config.items() %}
+{{ key }} = {{ value }}
+{% endfor %}