Flashing Or Masonry
These two produce similar stains in similar places and need completely different trades, so working out which is worth doing before anybody quotes.
Short answer
A flashing leak appears during rain, is worse with wind from one direction, and stains the ceiling beside the chimney. A masonry leak appears a day or two after rain, stains the chimney breast itself, and comes with efflorescence. The timing is the most reliable single indicator.
Signs it is the flashing
It appears during rain, and stops shortly after.
It is worse with wind from a particular direction.
The staining is on the ceiling beside the chimney rather than on the chimney breast.
There is evidence in the attic at the chimney penetration during rain.
The flashing is visibly surface-mounted with caulk rather than step flashing woven into the courses with counter flashing in a mortar joint.
And there is no cricket behind a wide stack, so water sits on the upslope side.
Timing is the test
During rain means the water has a direct route in, which is the flashing or the top of the flue. A day or two after rain means the masonry absorbed it and is now releasing it inward. Note the timing in two or three separate rain events before deciding, because one observation can mislead.
Signs it is the masonry
It appears a day or two after rain rather than during it.
It is worse after prolonged rain than after a short heavy shower.
The staining is on the chimney breast itself, inside the house.
There is efflorescence — white powdery staining — on the brick outside or inside.
The brick is visibly spalling, or the joints are open.
And the crown is cracked or is a mortar wash, which is the usual entry point from the top.
The other two possibilities
Down the flue from the top: no cap, a cracked crown, or cracked tiles. Shows as water in the firebox and a rusted damper rather than as a ceiling stain.
Condensation inside the flue: an oversized or cold flue with an appliance running. Shows in cold weather with no rain at all, which rules the other causes out immediately.
A roof leak elsewhere running along framing and appearing near the chimney, which is the chimney getting blamed for somebody else problem.
All of which means: observe it over a few events, note the timing and the conditions, and look in the attic during rain.
That costs nothing and it directs the money at the right thing.
And on a chimney that has several of these at once, which is common on an older stack, deal with them in order of cost: cap, crown, flashing, pointing, liner.
Common questions
How do I tell flashing from masonry?
During rain points at the flashing. A day or two later points at the masonry.
What if it leaks with no rain at all?
Condensation inside the flue, which means the flue size or the liner.
What order should I fix things in?
Cap, crown, flashing, pointing, liner — cheapest and most likely first.