Hi all,
I am currently working on setting up the elasticsearch logging which is defined in the file log4j2.properties.
My elasticsearch version is 5.2.2
My elk logs are located in /home/elk/elk/logs/es-9200
my cluster is named elk-cluster
What I want to do:
Roll the access logs on a daily basis and delete rolled files, that are older than one day (for testing purposes).
The rolling part is working fine, every day a new *.gz file is created.
But the gz files are not deleted and I just don't see what I did wrong in my configuration here.
Can you please have a look and point me into the right direction?
Thanks a lot 
appender.access_rolling.type = RollingFile
appender.access_rolling.name = access_rolling
appender.access_rolling.fileName = ${sys:es.logs}_access.log
appender.access_rolling.layout.type = PatternLayout
appender.access_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n
appender.access_rolling.filePattern = ${sys:es.logs}_access.log-%d{yyyy-MM-dd}.gz
appender.access_rolling.policies.type = Policies
appender.access_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.access_rolling.policies.time.interval = 1
appender.access_rolling.policies.time.modulate = true
appender.access_rolling.strategy.type = DefaultRolloverStrategy
appender.access_rolling.strategy.action.type = Delete
appender.access_rolling.strategy.action.basepath = /home/elk/elk/logs/es-9200
appender.access_rolling.strategy.action.condition.type = IfLastModified
appender.access_rolling.strategy.action.condition.age = 1D
appender.access_rolling.strategy.action.PathConditions.type = IfFileName
appender.access_rolling.strategy.action.PathConditions.glob = elk-cluster_access.log-*
logger.access_rolling.name = org.elasticsearch.access
logger.access_rolling.level = trace
logger.access_rolling.appenderRef.access_rolling.ref = access_rolling
logger.access_rolling.additivity = false
And do you have any idea how to test this log4 properties settings?