Agent is started in managed mode with the standard install command (with a manual restart due to enrollment issues as mentioned here: Elastic Agent won't enroll - #12 by greggailly).
All agents are started on different servers with different users so user permissions might have an influence.
Logs are too big to be opened but from what we could see at the start, most of the content is comes from indexing issues (due to grok parsing failure) being logged.
For now we unchecked "Collect agent logs" from the policy and all servers seem to have the "standard" 10Mb/7 files rotation.
It looks like this option has an impact on rotation.
Thanks for the help !