# How to archive the messages from logstash

**URL:** <https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719>\
**Category:** Logstash\
**Created:** [March 13, 2018, 11:04am UTC](https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719 "2018-03-13T11:04:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sunil\_Villuri](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Sunil\_Villuri](https://discuss.elastic.co/u/Sunil_Villuri)\
**Post date:** [March 13, 2018, 11:04am UTC](https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719/1 "2018-03-13T11:04:49Z")

</div>

Hi All,

i want to archive the old files for every month automatically.Could you please let us know the possibility and mechanism

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [March 13, 2018, 12:51pm UTC](https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719/2 "2018-03-13T12:51:30Z")

</div>

You mean your created index in elasticearch? As logstash does not "store" data but rather sends it to elasticsearch.

If this is the case you need to move it to the elasticsearch discussion board.

---

<div class="post-metadata">

**Author:** ![Sunil\_Villuri](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Sunil\_Villuri](https://discuss.elastic.co/u/Sunil_Villuri)\
**Post date:** [March 13, 2018, 2:21pm UTC](https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719/3 "2018-03-13T14:21:08Z")

</div>

No. I mean i have a log file which is continously storing gbs of data in  
2-3 days,which is read by logstash.

I want to archive the logs into seperate file and appending logs  
similarly to some other location. So i can maintain my memory in the  
system wise by ziping the file

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [March 13, 2018, 2:27pm UTC](https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719/4 "2018-03-13T14:27:03Z")

</div>

Ah ok, well as far as I know you cannot that with logstash, you need an external process for that.

---

<div class="post-metadata">

**Author:** ![murlin99](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@murlin99](https://discuss.elastic.co/u/murlin99)\
**Post date:** [March 13, 2018, 2:38pm UTC](https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719/5 "2018-03-13T14:38:40Z")

</div>

On the Linux servers I manage the log rotation is controlled by logrotate which automatically rotates and compresses the logs at intervals specified in the configuration. I keep 7 days in Elasticsearch and 3 months of raw compressed logs on the logging server.

Logstash will know when the log has rotated and continue reading it.

I am not sure how to do this on a Windows setup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2018, 2:38pm UTC](https://discuss.elastic.co/t/how-to-archive-the-messages-from-logstash/123719/6 "2018-04-10T14:38:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.