Delete Old Log Files

[areller]

I'm using Filebeat on windows server.
I write logs from my applications to the following path format: C:\AppLogs\{AppName}\{yyyy}-{MM}-{dd}.txt

I need to have the ability to delete old log files. I don't want my drive to run out of storage every couple months.

What would be the best way to do it?

Currently, my idea is to have a script (Powershell probably) that runs once a day and searches in the path C:\AppLogs\**\*.txt for logs files that are older than Today (By comparing the current date with the name of the file). It looks for the candidate file names in the Filebeat registry to see if the offset is equal to the size of the file, if so, it deletes the file.

Is it a good idea? Or is it some other tool that will do it automatically?
Is there something the Filebeat has out of the box?

Thank you.

[andrewkroh]

Reading Filebeat's registry could lead to problems because Filebeat is constantly updating the file. In the worst case it might even cause issues if Filebeat cannot modify the registry because you have it open. And the format of this file might change in a new release (there are no guarantees made about this file format). So I'd avoid trying to read this data.

You could probably rely on the fact that Filebeat will have the file open if its not done reading it. I would probably set a reasonable time period to start purging old logs and then attempt to open the file with exclusive rights (FileShare flag of 0) to determine if any other app still has an open handle to the file. Then delete if nothing else is accessing the file.

[areller]

Thank you for your response!
So basically, the state of offset == file size is equivalent to filebeat closing the log file, right?
If so, it sounds like a better solution.

By the way, out of interest, what about reading the .old registry file? From the filebeat src I see that whenever the registry gets updated, it copies it to an .old before writing to the actual registry. Would it be safe to read from the .old file?