Skip to content

Add logrotate configuration for Elasticsearch logs #61

@Oddly

Description

@Oddly

Description

The role does not manage logrotate for Elasticsearch log files. In production environments, Elasticsearch can generate significant log volume (especially with audit logging enabled), and without logrotate the /var/log/elasticsearch/ directory can fill up.

Suggested configuration

A reasonable default logrotate config:

/var/log/elasticsearch/*.log {
    daily
    rotate 32
    size 50M
    copytruncate
    compress
    delaycompress
    missingok
    notifempty
    maxage 370
    create 644 elasticsearch elasticsearch
}

Suggested approach

Add a template logrotate-elasticsearch.j2 with configurable variables for rotation count, max size, and max age. Deploy to /etc/logrotate.d/elasticsearch. Enable by default since it's a safe, non-disruptive addition.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions