Hy, I have few services that create a lot of logs and I want to start using ES + logfile to parse them. Now, since once logs are parsed and send to ES I don't need them(and since I'm forced to use on premise server with limited hard disk it shuts down server and application is turned off - which can't happen! when docker logs fill all of serves hard disk). I limit docker logs in odcker compose to 50MB(
max-size: "50m"). My question is will this distort filebeats is harvesting interval is small enough? In other words, will I miss any logs in ES because of limiting docker logs size?
Thans for any help and tips, great community!