# Filebeat/Metricbeat logs rotation

**URL:** https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744
**Category:** Beats
**Created:** [August 16, 2018, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744 "2018-08-16T15:31:29Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![BiNaP](https://avatars.discourse-cdn.com/v4/letter/b/a5b964/32.png) [@BiNaP](https://discuss.elastic.co/u/BiNaP)
#### Post date: [August 16, 2018, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744/1 "2018-08-16T15:31:29Z")

</div>

Hello everyone,

On my server, I've Filebeat and Metricbeat installed by RPM.

So I have folders in /etc for each product : /etc/metricbeat & /etc/filebeat.

My question is about the log rotation : I have searched in the process definition, in the yaml configuration file, in the logrotate.conf file, in logrotate.d  
I'm still not able to find how my logs files are managed/purged/rotated.

In /var/log/metricbeat (or /var/log/filebeat), I have 7 files, the currently written log file, and 6 backlogs. Each of these 6 backlogs have a size of 10M.

Could you please tell me if there is settings where I can set how the logs must be managed ?

Best regards,  
BiNaP.

---

<div class="post-metadata">

### Author: ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 17, 2018, 7:50am UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744/2 "2018-08-17T07:50:58Z")

</div>

Logging options can be customized using the following config options (e.g Filebeat). See more about the below options here: [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html)

```auto
# Logging to rotating files. Set logging.to_files to false to disable logging to
# files.
logging.to_files: true
logging.files:
  # Configure the path where the logs are written. The default is the logs directory
  # under the home path (the binary location).
  #path: /var/log/filebeat

  # The name of the files where the logs are written to.
  #name: filebeat

  # Configure log file size limit. If limit is reached, log file will be
  # automatically rotated
  #rotateeverybytes: 10485760 # = 10MB

  # Number of rotated log files to keep. Oldest files will be deleted first.
  #keepfiles: 7

  # The permissions mask to apply when rotating log files. The default value is 0600.
  # Must be a valid Unix-style file permissions mask expressed in octal notation.
  #permissions: 0600

# Set to true to log messages in json format.
#logging.json: false

```

---

<div class="post-metadata">

### Author: ![BiNaP](https://avatars.discourse-cdn.com/v4/letter/b/a5b964/32.png) [@BiNaP](https://discuss.elastic.co/u/BiNaP)
#### Post date: [August 17, 2018, 12:38pm UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744/3 "2018-08-17T12:38:59Z")

</div>

Thank you @kvch. It is, indeed, set where you suggest for my Filebeat installation.

I'll apply the same for Metricbeat, I assume it can be done as well as for Filebeat.

---

<div class="post-metadata">

### Author: ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 17, 2018, 1:27pm UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744/4 "2018-08-17T13:27:23Z")

</div>

Yes, you can.

---

<div class="post-metadata">

### Author: ![BiNaP](https://avatars.discourse-cdn.com/v4/letter/b/a5b964/32.png) [@BiNaP](https://discuss.elastic.co/u/BiNaP)
#### Post date: [August 17, 2018, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744/5 "2018-08-17T13:53:17Z")

</div>

Thank you again, @kvch.

I think this topic can be closed.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2018, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744/6 "2018-09-14T15:53:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
