Elasticsearch 5.2.2 log4.properties does not delete rolled files

Hi all,

I am currently working on setting up the elasticsearch logging which is defined in the file log4j2.properties.
My elasticsearch version is 5.2.2

My elk logs are located in /home/elk/elk/logs/es-9200
my cluster is named elk-cluster

What I want to do:
Roll the access logs on a daily basis and delete rolled files, that are older than one day (for testing purposes).

The rolling part is working fine, every day a new *.gz file is created.
But the gz files are not deleted and I just don't see what I did wrong in my configuration here.
Can you please have a look and point me into the right direction?

Thanks a lot :slight_smile:

appender.access_rolling.type = RollingFile
appender.access_rolling.name = access_rolling
appender.access_rolling.fileName = ${sys:es.logs}_access.log
appender.access_rolling.layout.type = PatternLayout
appender.access_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n
appender.access_rolling.filePattern = ${sys:es.logs}_access.log-%d{yyyy-MM-dd}.gz
appender.access_rolling.policies.type = Policies
appender.access_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.access_rolling.policies.time.interval = 1
appender.access_rolling.policies.time.modulate = true
appender.access_rolling.strategy.type = DefaultRolloverStrategy
appender.access_rolling.strategy.action.type = Delete
appender.access_rolling.strategy.action.basepath = /home/elk/elk/logs/es-9200
appender.access_rolling.strategy.action.condition.type = IfLastModified
appender.access_rolling.strategy.action.condition.age = 1D
appender.access_rolling.strategy.action.PathConditions.type = IfFileName
appender.access_rolling.strategy.action.PathConditions.glob = elk-cluster_access.log-*

logger.access_rolling.name = org.elasticsearch.access
logger.access_rolling.level = trace
logger.access_rolling.appenderRef.access_rolling.ref = access_rolling
logger.access_rolling.additivity = false

And do you have any idea how to test this log4 properties settings?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.