Disable automatic rotation Filebeat

[Clement_Ros]

Hi,

I use logrotate to rotate le log, and i wanted to know how can i disable the automatic rotation of Filebeat ?
I already try to change the rotateeverybytes parameters :

# Configure log file size limit. If limit is reached, log file will be
# automatically rotated
#rotateeverybytes: 10485760 # = 10MB
rotateeverybytes: 4294967296000 # = 500Go

But this not seems to work :

-rw-r--r-- 1 root root   8477287 Oct 26 10:25 filebeat.log
-rw-r--r-- 1 root root         0 Oct 26 00:01 filebeat.log.1
-rw-r--r-- 1 root root       936 Oct 25 15:15 filebeat.log.2
-rw-r--r-- 1 root root       936 Oct 25 15:47 filebeat.log-20161025
-rw-r--r-- 1 root root  51881520 Oct 26 00:01 filebeat.log.3
-rw-r--r-- 1 root root 201439926 Oct 25 14:57 filebeat.log.4
-rw-r--r-- 1 root root         0 Oct 25 00:01 filebeat.log.5
-rw-r--r-- 1 root root         0 Oct 24 00:00 filebeat.log.6

Thanks

[ruflin]

This is currently not possible. Best follow https://github.com/elastic/beats/issues/2764 for more details.

[Clement_Ros]

Thanks for the information.

So the only way to do this is to set a high value to the "rotateeverybytes".

In my configuration i had put the value to 500Go and my log file did rotate before reaching 500Go.
What is the reason ?

[ruflin]

It gets rotated every time on restart. Could that be the reason? Or does it get rotated during running?

[steffens (Steffen Siering)]

The thing is, logrotate needs to tell the application it is about to rotate a log file. normally this is done by sending a signal (e.g. SIGHUB) to the process (which is not supported by go runtime for platform compatibility). Without logrotate telling the process the files has changed (e.g. forcing restart), the process will continue writing into the old file. If copy is used in logrotate or file is compressed from original log as is, logs might get missing as well.

I guess you're setting 500gb log file in filebeat + copytruncate in logrotate?

[Clement_Ros]

Hi,

Filebeat rotate the log file every time on restart. Can i disable that ?

[ruflin]

This is currently not possible. It's probably worth to also add this to https://github.com/elastic/beats/issues/2764